The report
A public ChatGPT conversation link should expose only the material its author chose to share. Parameter's technical reconstruction describes a different outcome in controlled tests: opening a crafted share initiated an HTML Preview and MathLive messaging chain that eventually ran script with the signed-in ChatGPT origin and reached a private conversation API.
The attacker-controlled starting material was the public share, not a signed-in user's deliberate instruction to disclose another conversation. The reported failure involved moving lower-trust component messages across a browser origin and account-access boundary. Parameter dates the fix to October 26, 2026. The researchers' proof of access does not establish widespread exploitation, and their report should not be taken as an independently audited fix regression test.
The Case ties the share, embedded message transport and private API effect to one chain. The defense question is whether preview content remains isolated under its own origin and whether messages from embedded components are checked before reaching account APIs.
Why two ordinary features combined into an account-boundary failure
Parameter researcher Mukul Goyal's October 28 write-up identifies the precise trust transition: the graph installed a MathLive virtual-keyboard receiver in the authenticated document, while the HTML Preview remained cross-origin but could send postMessage. The receiver accepted a layout replacement message and a show command. It treated supplied markup as HTML and wrote it into the main document; an iframe srcdoc step supplied the script execution route. The researchers used a controlled account to retrieve a private conversation. This was a browser component and origin-validation exploit, not a prompt-injection attack by a model. The reported October 26 fix predates the October 28 public research article.
Why the final script stage mattered
The research did not rely on the browser executing a normal script element inserted by innerHTML: such elements are not generally executed when added through that sink. The controlled payload instead used an unsandboxed srcdoc iframe that inherited the authenticated origin and a YouTube oEmbed JSONP callback permitted by the page's Content Security Policy. That combination explains how otherwise constrained markup could lead to authenticated API requests. The reported remediation fixed cross-frame MathLive message handling in two frontend variants on October 26; a CSP-only block on this one callback would not by itself close the unauthorized message route. Mukul Goyal is the named researcher for the report. The test proves a controlled origin-boundary breach, not the number of real users affected.
What the single-link delivery changed
The initial proof required a researcher-controlled App; the final carrier kept the graph and Preview inside one native public share. Parameter says a manual Preview click worked first, followed by an automatically previewable version reproduced three times in a separate account. That distinction matters because it removes an additional installation or connection step from the reported attack path. The underlying origin-boundary Case records the exact trusted receiver and HTML sink. This is a browser component exploit carried by AI-adjacent content, not evidence that the language model independently chose to disclose private chats. The reported October 26 fix precedes the public October 28 write-up, and independent post-fix testing was not disclosed. See the researcher Mukul Goyal and the related contextual-disclosure boundary.