ChatGPT Bug Let a Public Share Link Take Over Your Account

Security researchers at Parameter, a security research group, found a vulnerability in OpenAI's chatbot, ChatGPT. It let attackers take over other people's accounts using nothing more than a regular public share link. Normally, when you share something from ChatGPT, people see a preview of the conversation. But the researchers noticed something. If a chat contains a chart and an HTML Preview, a feature that turns code into a small working site, you could exploit a bug in the MathLive library, which ChatGPT uses to render charts. This library does not check who sent the message. That means an attacker's Preview could run malicious code outside the sandbox, the isolated area where code is supposed to run, with the rights of the legitimate user. The victim just has to click the link sent to them. After that, the attacker's code could list the victim's conversations, read the contents of their private chats, meaning chats never shared with anyone, and take actions on the victim's behalf. The researchers reported the bug to OpenAI on October 18. OpenAI fixed it on October 26. They classified it as P1, the highest severity level, and paid the researchers $5,000 through their bug bounty program, a paid program that rewards people for finding vulnerabilities.

A simple screenshot preview could carry all the rights of the legitimate user. The preview and sharing feature is a critical part of the security boundary in any AI chat app. Paying just $5,000 for a bug that could compromise a user's entire account is a pretty good deal.