Cases › security breach › LR-2026-0299
ChatGPT shared-link Preview sandbox escape via MathLive postMessage listener
Preliminary Why: 1 report: The Hacker News · subject to change · 1 independent report
Severity minor: The flaw was demonstrated only in a controlled test between separate accounts with no real-world use reported, and OpenAI paid a $5,000 bounty.
Earliest source we hold 2026-10-31 · Captured by AI Risk Wire 2026-10-31 20:30 UTC
A malicious ChatGPT share link could run an attacker's code in the logged-in session of anyone who opened it, allowing them to read their private conversations, researchers at the security firm Parameter showed.
Risks this incident falls under
| Risk | Role | NIST AI 600-1 | Incidents | Last 6 quarters |
|---|---|---|---|---|
| AI used to run a cyber attack | Primary | Information Security | 35 | |
| AI system attacked or breached | Also | Information Security | 1 |
Sorted by rule from the case's fields; not yet read from the sources.
Control failure chain
L1 · ModelOpenAIModel provider
Sources not yet read for controls.
Model version not linked to a model card.
Other controls for this risk at this layer, not yet read for: Safety training and refusal, Cyber and weapons safeguards, Abuse monitoring and account enforcement, Staged or restricted release, Dangerous-capability testing before release, Outside red-teaming, Content safety classifiers, Safeguards kept on in testing, Reasoning monitoring.
L2 · HarnessChatGPT web frontend (shared chat links with Preview and interactive graph features)Agent framework vendor
Sources not yet read for controls.
L3 · ApplicationDeployer not namedDeployer
Sources not yet read for controls.
L4 · Infrastructure / targetOrganisation hit
Sources not yet read for controls.
Other controls for this risk at this layer, not yet read for: Known flaws patched, Multi-factor sign-in and password policy, Network segmentation, Intrusion and endpoint detection, Backups and recovery, Phishing and fraud filters.
HeldFailedGot aroundMissingNot mentionedNot read yetAttacker's ownOrder: model · harness · application · target
The same controls in other incidents of this risk
| Control | Layer | Here | Held elsewhere | Did not hold elsewhere |
|---|---|---|---|---|
| Content safety classifiers | L1 Model | Not read yet | none | none |
| Safety training and refusal | L1 Model | Not read yet | none | 1 |
| Cyber and weapons safeguards | L1 Model | Not read yet | none | none |
| Dangerous-capability testing before release | L1 Model | Not read yet | none | none |
| Outside red-teaming | L1 Model | Not read yet | none | none |
| Staged or restricted release | L1 Model | Not read yet | none | none |
| Abuse monitoring and account enforcement | L1 Model | Not read yet | none | none |
| Reasoning monitoring | L1 Model | Not read yet | none | 1 |
| Safeguards kept on in testing | L1 Model | Not read yet | none | none |
| Known flaws patched | L4 Infrastructure / target | Not read yet | none | none |
| Multi-factor sign-in and password policy | L4 Infrastructure / target | Not read yet | none | none |
| Network segmentation | L4 Infrastructure / target | Not read yet | none | none |
| Intrusion and endpoint detection | L4 Infrastructure / target | Not read yet | none | none |
| Backups and recovery | L4 Infrastructure / target | Not read yet | none | none |
| Phishing and fraud filters | L4 Infrastructure / target | Not read yet | none | none |
Remediation
Fix reported
“OpenAI rolled a fix across two versions of ChatGPT's web frontend; by October 26 both versions rejected the messages the attack relied on.”
No later incident for OpenAI under this risk on record.
Risk grouping: Not yet classified
No source we hold states: who caused it, intended or not, before or after release, the ai's part.
The story
What the sources state
- Direct loss $5,000
No source states: when it happened, how many records were exposed, a count of the other parties affected, any court case, the cause, what set it off.
Others like this
Missouri student's ChatGPT confession used as evidence in felony property-damage case 2026-10-31
Show every field, with its source and grade
The AI system
What happened
Impact
Context
LR-2026-0299 · version 2 · published 2026-10-31 after automatic checks; not yet checked field by field by a person · changes to this case · JSON