A security flaw in ChatGPT’s web app could expose a user’s private conversations, uploaded files and account information after they clicked a link, according to security firm Parameter. The attack could run in about 4.5 seconds and required no downloads or app permissions, but the user had to be signed in to ChatGPT while browsing.
The links could be sent through email, social media or private messages and appeared to lead to public ChatGPT conversations. Opening one could trigger malicious code under the chatgpt.com domain, where it could use the page’s permissions to read chat history and attachments or change account settings.
The researchers traced the issue to the open-source MathLive library, which ChatGPT uses for interactive math displays and virtual keyboards. The platform’s HTML preview feature did not verify the origin of incoming content or filter certain code blocks. Researchers also found that an exception for trusted partner services, including YouTube, could be used to run the script and send excerpts of conversations to an external server.
OpenAI was notified on October 18 and reproduced the attack in a controlled environment. It raised the incident’s priority from P2 to P1 and deployed server-side fixes between October 22 and 26. The MathLive team also released an update that checks message origins by default and blocks commands from external screens.
The researchers said they found no evidence that the flaw had been used against ordinary users; their tests involved accounts they controlled. Since OpenAI fixed the issue on its servers, users do not need to change their passwords or account settings, according to the report.
Sources: Canaltech.