Parameter Labs published a write-up on Oct 28 showing that an ordinary public ChatGPT share link could run attacker-controlled JavaScript inside the signed-in session of whoever opened it. In their tests the code listed the victim's conversations, read a private chat that had never been shared, and sent part of it to a researcher server. The researchers say it could "essentially" take any action as the victim on chatgpt.com.

• Step 1: ChatGPT's HTML Preview runs code in a sandboxed frame on a separate origin. That sandbox held.
• Step 2: an interactive graph in the same conversation loaded the MathLive library into the main page, which installed a postMessage listener for its virtual keyboard that accepted messages from any origin. The Preview sent it a keyboard layout containing HTML, which MathLive wrote into the page with innerHTML.
• Step 3: that HTML was an iframe srcdoc with no sandbox attribute, so it inherited the chatgpt.com origin.
• Step 4: ChatGPT's CSP allowed YouTube scripts, and YouTube's oEmbed endpoint echoed an invalid JSONP callback into its error response, which gave script execution.

Timeline (per Parameter): reported through OpenAI's bug bounty Oct 18, fixed Oct 26, rated P1. A later version opened Preview automatically, so opening the link was the only step. Parameter reports no real-world use and ran its proof between its own accounts. There's nothing for users to patch.

For builders: any third-party widget in a trusted page that listens for postMessage without checking the sender is a hole in your sandbox, and every script host in your CSP allowlist that serves JSONP is a script-injection gadget.