THE SHORT VERSION
- Researchers at Parameter showed that a crafted public ChatGPT share could run their JavaScript in the signed-in session of anyone who opened it.安全公司 Parameter 证明，一条精心构造的公开 ChatGPT 分享链接可在打开者的登录会话中执行攻击者代码。
- The payload could list recent conversations, open a private chat the attacker never had access to, and send part of it to an external server.载荷可列出最近会话、打开从未分享给攻击者的私聊，并把其中一部分发往外部服务器。
- OpenAI reproduced the issue, raised it from P2 to P1, and fixed it on October 26 across two versions of the ChatGPT web frontend.OpenAI 复现问题后把严重度从 P2 提升到 P1，并于 10 月 26 日在两个版本的前端完成修复。
What the researchers demonstrated研究者演示了什么
The Hacker News reported that a malicious ChatGPT share link could run an attacker's code in the logged-in session of anyone who opened it, allowing them to read private conversations. The research came from Parameter, a security firm, and the trap was an ordinary conversation shared through ChatGPT's normal public-link feature.The Hacker News 报道称，一条恶意 ChatGPT 分享链接可在打开者的登录会话中执行攻击者代码，从而读取私密对话。研究来自安全公司 Parameter，陷阱是一个通过 ChatGPT 正常公开分享功能发布的普通对话。
Parameter's own write-up describes the test: the payload could enumerate the victim's conversation list, retrieve content from a private conversation that had never been shared with the attacker, and send data from that conversation to an external server. The victim did not have to install an app, join a project, paste code or open developer tools.Parameter 自己的说明描述了这次测试：载荷可以枚举受害者的会话列表、取回一段从未分享给攻击者的私密对话内容，并把其中数据发往外部服务器。受害者无需安装应用、加入项目、粘贴代码或打开开发者工具。
How the chain crossed the sandbox链条如何越过沙箱
ChatGPT can turn an HTML block into a small working page through its Preview feature. Because that page can contain arbitrary code, it runs in a restricted frame on a separate web address, where it cannot read the main ChatGPT page around it. The question Parameter started from was simple: if Preview code is boxed into a different site, what can it still talk to?ChatGPT 可以通过 Preview 功能把一段 HTML 变成可运行的小网页。由于该页面可能包含任意代码，它被放在另一网址上的受限框架内运行，无法读取周围的 ChatGPT 主页面。Parameter 的起点问题很简单：如果 Preview 代码被关在另一个站点里，它还能和谁通信？
The answer was a message listener. The shared conversation contained an interactive graph that loaded MathLive, a maths library, into the main page. Loading it also installed a listener for messages about MathLive's on-screen keyboard, and that listener accepted messages from any sender and allowed the keyboard layout to contain raw HTML. The Preview could then send HTML across the boundary into the trusted page.答案是消息监听器。被分享的对话里含有一张交互图表，它会把数学库 MathLive 加载进主页面。加载它的同时也在主页面安装了一个监听器，用来接收与 MathLive 屏幕键盘相关的消息；该监听器接受来自任意发送者的消息，并允许键盘布局包含原始 HTML。于是 Preview 可以把 HTML 越过边界送进受信任的页面。
From HTML to code execution从 HTML 到代码执行
The HTML built a new frame that the browser treated as part of chatgpt.com, and a script loaded from YouTube supplied the code that ran inside it. The researchers noted that ChatGPT's content security policy blocked inline code but allowed scripts from YouTube, which is why that step worked.这段 HTML 建立了一个被浏览器视为 chatgpt.com 一部分的新框架，而一段从 YouTube 加载的脚本提供了在其中运行的代码。研究者指出，ChatGPT 的内容安全策略禁止内联代码，却允许来自 YouTube 的脚本，这正是该步骤成立的原因。
They also emphasised that the YouTube step was a workaround rather than the cause. Blocking it alone would still leave an untrusted Preview able to push HTML into the main site. The underlying problem was two unrelated features, the graph library and the sandbox, combining into a path that neither was designed to create.他们也强调，YouTube 这一步只是权宜手段，而非根因。单是封掉它，不受信任的 Preview 仍然可以把 HTML 推进主站。真正的问题是两个互不相关的功能——图表库与沙箱——组合出一条两者都未曾设计过的通路。
What the payload could do载荷能做什么
The code called ChatGPT's own signed-in APIs directly rather than reading what happened to be on the screen. Parameter said that because it ran with the victim's full web access, its reach was not limited to the chats they demonstrated. The write-up puts it plainly: essentially, they could perform any action on behalf of the victim's ChatGPT account.这段代码直接调用 ChatGPT 自身的已登录 API，而不是读取屏幕上的内容。Parameter 称，由于它以受害者的完整网页权限运行，其影响范围并不限于他们所演示的那几个会话。文中说得很直白：本质上，他们可以代替受害者的 ChatGPT 账号执行任何操作。
The demonstration was a controlled test. Parameter said it does not report any real-world use of the flaw and ran the private-chat proof between separate accounts rather than against real users. That distinction matters for readers: a demonstrated capability is not the same as evidence of exploitation.这次演示是受控测试。Parameter 表示未发现该漏洞在真实世界被利用，且私聊证明是在两个不同账号之间完成的，而非针对真实用户。这一区别对读者很重要：被证明的能力，与有证据表明已被利用，不是一回事。
What OpenAI changedOpenAI 改了什么
According to Parameter, OpenAI reproduced both the code execution and the private-conversation proof, raised the severity from P2 to P1, and rolled a fix across two versions of ChatGPT's web frontend. By October 26, both versions rejected the messages the attack relied on. The firm said it submitted the report to OpenAI's bug bounty programme.据 Parameter 称，OpenAI 复现了代码执行与私聊证明，把严重度从 P2 提升到 P1，并在两个版本的 ChatGPT 网页前端上线修复。到 10 月 26 日，两个版本都会拒绝该攻击所依赖的消息。该公司称已把报告提交给 OpenAI 的漏洞赏金计划。
The fix addresses the message path rather than the individual payload, which is the right level: the listener no longer accepts messages from unapproved senders, so the Preview can no longer hand HTML to the trusted page. That closes the chain the researchers used, though the lesson about cross-feature interactions applies to any product that combines user-rendered content with a sandbox.修复针对的是消息通路而非单个载荷，这是正确的层级：监听器不再接受未经批准的发送者消息，Preview 也就无法再把 HTML 交给受信任页面。这关闭了研究者使用的链条，但「功能间相互作用」这一教训，对任何把用户渲染内容与沙箱结合的产品都适用。
The disclosure timeline披露时间线
The write-up gives dates for each step, which is useful for judging how the response went. Parameter found the issue in October, reproduced the chain through the normal interface on October 14, upgraded the fixed alert to arbitrary JavaScript the same day, and submitted the report to OpenAI's bug bounty programme on October 18. OpenAI fixed it on October 26 and classified it as P1.这份说明给出了每一步的日期，有助于判断响应过程。Parameter 在 10 月发现问题，10 月 14 日通过正常界面复现整条链条，同日把固定弹窗升级为任意 JavaScript，并在 10 月 18 日把报告提交给 OpenAI 的漏洞赏金计划。OpenAI 于 10 月 26 日修复，并将其归类为 P1。
That is eight days from report to fix, and the severity change, from P2 to P1, is the part worth noticing: it means the initial triage underrated what the researchers had shown. The firm also said the fix was rolled out across two frontend versions, with one version needing an update during the rollout, which is the ordinary messiness of shipping a security fix to a live product.从报告到修复共八天；值得注意的部分是严重度从 P2 提升到 P1——这意味着最初的研判低估了研究者所展示的内容。该机构还称修复在两个前端版本上线，其中一个版本在推送过程中还需要一次更新，这是把安全修复发布到在线产品时常见的混乱。
What is established, and what is not哪些已经确定，哪些还没有
Established: a crafted public ChatGPT share could execute JavaScript in a signed-in session and read private conversations; the chain relied on a MathLive message listener and a Preview frame; OpenAI reproduced it, raised the severity to P1 and fixed it by October 26; the demonstration was a controlled test with no reported real-world exploitation. Not established: whether the issue was ever exploited before the fix, whether other cross-frame listeners remain, and what the bounty payment was.已经确定的：一条精心构造的公开分享链接可在登录会话中执行 JavaScript 并读取私聊；链条依赖 MathLive 消息监听器与 Preview 框架；OpenAI 复现问题、把严重度提升至 P1，并在 10 月 26 日前修复；演示为受控测试，未见真实利用报告。尚未确定的：修复前是否曾被利用、是否还存在其他跨框架监听器，以及赏金金额。
For readers, the useful takeaway is that link-preview features are part of the attack surface of AI products, not decoration. This site has covered a hardware flaw that produced dangerous answers, a trojanised Claude Code extension and the controls Anthropic proposes for high-risk models; all three describe the same pattern, where a convenience feature becomes the way in.对读者而言，有用的结论是：链接预览功能是 AI 产品攻击面的一部分，而不是装饰。本站报道过一起硬件缺陷产生危险回答的事件与被投毒的 Claude Code 扩展；以及Anthropic 提出的高风险模型验证机制；它们描述的是同一种模式：便利功能成了进入的入口。
Sources & reporting limits来源与核查范围
Follow Industry to find related stories on your next visit.关注产业动态，下次访问时阅读相关文章。
