Security researchers at Parameter Labs described an exploit they found against ChatGPT's implementation of its interactive HTML apps feature (previously called 'Canvas,' now called 'HTML previews'), in which custom HTML apps run inside a sandboxed iframe, according to a link post by Simon Willison published on 31st October 2026. The researchers found a multi-step attack chain. OpenAI uses the MathLive JavaScript library, which includes a virtual keyboard that could be triggered in the parent page via postMessage() from the sandboxed iframe. That receiving code used innerHTML, allowing injected HTML from any message-sending frame, including HTML preview frames, with no mechanism preventing it. While innerHTML does not directly run scripts, it could inject a new iframe without sandbox restrictions. OpenAI's content security policy blocked inline scripts and limited script sources, but one allowed domain was YouTube, whose oEmbed endpoint could reflect executable JavaScript. Once JavaScript ran on ChatGPT, attackers could fetch private user data and exfiltrate it via an image reference. The result: a ChatGPT share URL that, when opened by another signed-in user, could steal their private data or act on their behalf. Willison reports OpenAI closed the hole and paid a $5,000 bug bounty, which he characterized as low for a vulnerability of this severity.
- Attack chain abused MathLive's virtual keyboard, innerHTML, and YouTube's oEmbed endpoint to run code on ChatGPT
- A malicious ChatGPT share URL could exfiltrate another signed-in user's data or act on their behalf
- OpenAI has fixed the vulnerability and paid a $5,000 bug bounty
What it means for you
A shared ChatGPT link could, before this was fixed, have quietly stolen data or taken actions for anyone who opened it while logged in. OpenAI has already patched it, so there's nothing broken to fix today. The lasting lesson is simpler: a link from a tool you trust is still a link someone else made, and 'click to open in ChatGPT' deserves the same caution as any other link.
Try this
This week, remind your team of one plain rule: treat shared AI-tool links (ChatGPT, Claude, and similar) like any unknown link — don't open one just because it came through a familiar tool, especially while signed into a work account.
Who should care
Anyone whose staff share or open ChatGPT links at work, and whoever owns IT security or acceptable-use policy for AI tools.
Skip this if
Your organization doesn't use ChatGPT's share feature, or your people already treat all shared links with routine caution — the hole itself is already closed.
Sources: Simon Willison — read the original