{"schema_version":"0.10.0","id":"LR-2026-0299","record_version":2,"title":"ChatGPT shared-link Preview sandbox escape via MathLive postMessage listener","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":54.8,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":6.0,"completeness":8.0,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-10-31","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"1 report: The Hacker News · subject to change","original_document":null,"reports_total":1,"reports_independent":1,"reports_derivative":0,"developing":true,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-10-31","history":[{"date":"2026-10-31","from_level":null,"to_level":"preliminary","reason":"1 report: The Hacker News · subject to change"}]},"sources_hash":"09f142bd2640f27254d9a6b271336ed0701f8abb81fc1d3f81cb660b2bf78370"},"system":{"model_name":null,"model_version":null,"developer":"OpenAI","harness":"ChatGPT web frontend (shared chat links with Preview and interactive graph features)","tools_granted":[],"permissions_scope":"The victim's signed-in ChatGPT session, with the same access as the real ChatGPT site, including listing and reading private conversations","autonomy_level":"unknown","guardrails_present":["sandbox","content_security_policy"],"deployment_context":"production","tier":"provider","lifecycle_stage":"production","integration_type":"embedded","intended_use":null,"safeguard_state":null,"production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-10-31","incident_class":"security_compromise","failure_class":null,"agent_involved":false,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"public_researcher","summary":"A malicious ChatGPT share link could run an attacker's code in the logged-in session of anyone who opened it, allowing them to read their private conversations, researchers at the security firm Parameter showed.","tags":["shared-link","cross-frame-messaging","sandbox-escape","third-party-library","bug-bounty","private-chat-exposure"],"date_detected":null,"near_miss":true,"root_cause":null,"root_cause_detail":null,"failure_class_detail":"No autonomous agent was involved; the flaw was a cross-frame messaging and sandboxing weakness in ChatGPT's web frontend exploited by a malicious share link.","responsible_party":"provider","adversarial_actor":"external_attacker","input_provenance":"A shared ChatGPT conversation link containing a Preview HTML block and an interactive graph that loaded MathLive","time_to_contain":null,"operations_paused":null,"remediation":"OpenAI rolled a fix across two versions of ChatGPT's web frontend; by October 26 both versions rejected the messages the attack relied on.","precursor_events":null},"impact":{"direct_loss_usd":5000.0,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"minor","severity_because":"minor: The flaw was demonstrated only in a controlled test between separate accounts with no real-world use reported, and OpenAI paid a $5,000 bounty.","harm_class":["none_materialised"],"affected_description":"ChatGPT users who opened a malicious shared chat link; proof run between separate accounts rather than real users","protected_class_involved":null,"data_categories_exposed":["private_chats"],"loss_range_usd":null,"reversibility":"not_applicable","downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://thehackernews.com/2026/10/a-shared-chatgpt-link-could-run.html","publisher":"The Hacker News","date":"2026-10-31","type":"press","title":"A Shared ChatGPT Link Could Run Attacker Code in Your Session and Read Private Chats","archived_url":null,"attachment":"first_report","independence":"independent"}],"per_field_confidence":{"system.harness":"C","system.permissions_scope":"C","system.guardrails_present":"C","system.tier":"D","system.lifecycle_stage":"D","system.integration_type":"D","system.developer":"C","system.deployment_context":"D","system.autonomy_level":"D","event.tags":"D","event.near_miss":"C","event.responsible_party":"D","event.adversarial_actor":"C","event.input_provenance":"C","event.remediation":"C","event.agent_involved":"D","event.detection_method":"D","event.incident_class":"D","event.summary":"D","event.date_disclosed":"A","event.trigger":"D","impact.direct_loss_usd":"C","impact.harm_class":"C","impact.affected_description":"C","impact.data_categories_exposed":"C","impact.reversibility":"D","impact.severity":"D","context.industry":"D","context.systemic_exposure":"D","context.denominator_available":"D","context.country":"D","event.failure_class_detail":"D","impact.severity_because":"D"},"field_citations":{"system.developer":[{"source_index":0,"quote":"The researchers reported the flaw through OpenAI's bug bounty program on October 18, and OpenAI fixed it eight days later and rated it P1, its most serious category."}],"system.harness":[{"source_index":0,"quote":"Parameter said OpenAI reproduced both the code execution and the private-chat proof, raised the severity from P2 to P1, and rolled a fix across two versions of ChatGPT's web frontend."}],"system.permissions_scope":[{"source_index":0,"quote":"Once the link opened, the attacker's code ran inside the victim's signed-in session with the same access as the real ChatGPT site."}],"system.guardrails_present":[{"source_index":0,"quote":"Because that page can hold any code, ChatGPT runs it in a locked-down frame on a separate web address, where it cannot read the main ChatGPT page around it."},{"source_index":0,"quote":"ChatGPT's content security policy limits where a page's scripts may come from."}],"system.deployment_context":[{"source_index":0,"quote":"Once the link opened, the attacker's code ran inside the victim's signed-in session with the same access as the real ChatGPT site."}],"system.lifecycle_stage":[{"source_index":0,"quote":"Parameter said OpenAI reproduced both the code execution and the private-chat proof, raised the severity from P2 to P1, and rolled a fix across two versions of ChatGPT's web frontend."}],"system.integration_type":[{"source_index":0,"quote":"The shared chat also contained an interactive graph, and drawing it loaded a math library called MathLive into the main ChatGPT page."}],"event.detection_method":[{"source_index":0,"quote":"A malicious ChatGPT share link could run an attacker's code in the logged-in session of anyone who opened it, allowing them to read their private conversations, researchers at the security firm Parameter showed."}],"event.near_miss":[{"source_index":0,"quote":"The work was a controlled test. Parameter does not report any real-world use of the flaw, and ran its private-chat proof between separate accounts rather than against real users."}],"event.responsible_party":[{"source_index":0,"quote":"Parameter said OpenAI reproduced both the code execution and the private-chat proof, raised the severity from P2 to P1, and rolled a fix across two versions of ChatGPT's web frontend."}],"event.adversarial_actor":[{"source_index":0,"quote":"A malicious ChatGPT share link could run an attacker's code in the logged-in session of anyone who opened it, allowing them to read their private conversations, researchers at the security firm Parameter showed."}],"event.input_provenance":[{"source_index":0,"quote":"The trap was an ordinary ChatGPT conversation shared via its public link."}],"event.remediation":[{"source_index":0,"quote":"By October 26, both versions rejected the messages the attack relied on."}],"event.incident_class":[{"source_index":0,"quote":"Once the link opened, the attacker's code ran inside the victim's signed-in session with the same access as the real ChatGPT site."}],"event.agent_involved":[{"source_index":0,"quote":"The Preview could then reach across the boundary and hand attacker HTML to the trusted main page."}],"event.failure_class_detail":[{"source_index":0,"quote":"The Preview could then reach across the boundary and hand attacker HTML to the trusted main page."}],"event.summary":[{"source_index":0,"quote":"A malicious ChatGPT share link could run an attacker's code in the logged-in session of anyone who opened it, allowing them to read their private conversations, researchers at the security firm Parameter showed."}],"event.tags":[{"source_index":0,"quote":"The Preview could then reach across the boundary and hand attacker HTML to the trusted main page."}],"impact.direct_loss_usd":[{"source_index":0,"quote":"OpenAI paid a total of $5,000 for the report."}],"impact.harm_class":[{"source_index":0,"quote":"The work was a controlled test. Parameter does not report any real-world use of the flaw, and ran its private-chat proof between separate accounts rather than against real users."}],"impact.affected_description":[{"source_index":0,"quote":"The work was a controlled test. Parameter does not report any real-world use of the flaw, and ran its private-chat proof between separate accounts rather than against real users."}],"impact.data_categories_exposed":[{"source_index":0,"quote":"It listed the victim's recent conversations, opened a private chat that had never been shared with the attacker, and sent a small portion of it to a server controlled by the researchers."}],"impact.reversibility":[{"source_index":0,"quote":"The work was a controlled test. Parameter does not report any real-world use of the flaw, and ran its private-chat proof between separate accounts rather than against real users."}],"impact.severity_because":[{"source_index":0,"quote":"The work was a controlled test. Parameter does not report any real-world use of the flaw, and ran its private-chat proof between separate accounts rather than against real users."}],"context.industry":[{"source_index":0,"quote":"Parameter said OpenAI reproduced both the code execution and the private-chat proof, raised the severity from P2 to P1, and rolled a fix across two versions of ChatGPT's web frontend."}],"context.country":[{"source_index":0,"quote":"The researchers reported the flaw through OpenAI's bug bounty program on October 18, and OpenAI fixed it eight days later and rated it P1, its most serious category."}],"context.systemic_exposure":[{"source_index":0,"quote":"Parameter said OpenAI reproduced both the code execution and the private-chat proof, raised the severity from P2 to P1, and rolled a fix across two versions of ChatGPT's web frontend."}],"impact.severity":[{"source_index":0,"quote":"The work was a controlled test. Parameter does not report any real-world use of the flaw, and ran its private-chat proof between separate accounts rather than against real users."}],"event.date_disclosed":[{"source_index":0,"quote":"published: 2026-10-31"}]},"notes_on_gaps":"No source states event.date_occurred (only the October 18 report, October 26 fix and October 28 disclosure dates are given), so it is omitted; no dated timeline items exist, so no bounds. event.trigger is omitted: no source states what set the behaviour off beyond a malicious share link, and no source rules out an external cause. event.failure_class is null because no autonomous agent was involved. system.model_name, model_version, autonomy_level, intended_use, safeguard_state and production_intended are not stated. impact.third_parties_affected_count is null: no source says how many users were affected, and the proof ran between separate accounts, but no source states zero third parties. impact.records_exposed, remediation_hours, loss_range_usd, downstream_exposure_count and protected_class_involved are not stated. context.org_size_band, denominator and regulatory are not stated. system.tier and event.date_disclosed are derived by rule and not written here. Judgements: deployment_context, lifecycle_stage, integration_type, detection_method, root_cause, responsible_party, incident_class, agent_involved, reversibility, industry, country and systemic_exposure are classified from the cited sentences; systemic_exposure is marked true because the flaw sat in the shared ChatGPT web frontend used by all users, though no source uses that term. event.root_cause: the stated reason names an absence, not a failed control: Three design choices lined up: MathLive acted on a message without checking which frame sent it; that message could carry raw HTML as keyboard-layout data; and the HTML could create a frame that was not sandboxed and inherited the chatgpt.com identity. system.tier: provider by rule (the developer is named as the operator). [aggregated by deepseek-chat, aggregate-2026-09-27.1, 2026-10-31] system.lifecycle_stage: production. system.integration_type: embedded. system.deployment_context: production. system.autonomy_level: no source states the arrangement. event.tags: classified from described behaviour. event.responsible_party: provider. event.agent_involved: classified from described behaviour. event.detection_method: a source states an independent researcher or journalist found it. event.incident_class: a source states an attacker, an injected instruction or a misused credential caused the system to act, or that the system's own boundary (sandbox, permissions, weights, accounts) was breached. event.summary: classified from described behaviour. event.trigger: no source states a cause. impact.reversibility: not_applicable. context.industry: classified from described behaviour. context.systemic_exposure: classified from described behaviour. context.denominator_available: no denominator is available for this incident. context.country: classified from described behaviour."},"context":{"industry":"Information (software publishing / AI services)","org_size_band":null,"country":"US","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":true,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"ChatGPT's web frontend served shared conversation links; a shared chat could include a Preview HTML block and an interactive graph that loaded the MathLive library into the main chatgpt.com page.","quote":"The shared chat also contained an interactive graph, and drawing it loaded a math library called MathLive into the main ChatGPT page.","source_index":0,"grade":"C"},{"step":"went_wrong","text":"A malicious share link ran attacker code in the victim's signed-in ChatGPT session, crossing the frame boundary meant to keep Preview content away from the main page.","quote":"The Preview could then reach across the boundary and hand attacker HTML to the trusted main page.","source_index":0,"grade":"C"},{"step":"reached","text":"The code listed the victim's recent conversations, opened a private chat never shared with the attacker and sent a portion to a researcher-controlled server.","quote":"It listed the victim's recent conversations, opened a private chat that had never been shared with the attacker, and sent a small portion of it to a server controlled by the researchers.","source_index":0,"grade":"C"},{"step":"caught","text":"Researchers at the security firm Parameter found the flaw and reported it through OpenAI's bug bounty program on October 18.","quote":"The researchers reported the flaw through OpenAI's bug bounty program on October 18, and OpenAI fixed it eight days later and rated it P1, its most serious category.","source_index":0,"grade":"C"},{"step":"done","text":"OpenAI reproduced the attack, raised severity from P2 to P1 and rolled a fix across two ChatGPT web frontend versions; by October 26 both rejected the messages the attack relied on.","quote":"By October 26, both versions rejected the messages the attack relied on.","source_index":0,"grade":"C"}],"model":"deepseek-chat","prompt_version":"aggregate-2026-09-27.1","extracted_at":"2026-10-31","source_urls":["https://thehackernews.com/2026/10/a-shared-chatgpt-link-could-run.html"]}}