person · DiggingBeagle record
Mukul Goyal
Security researcher credited on the October 28 2026 Parameter technical report describing the ChatGPT HTML Preview and MathLive postMessage origin compromise.
- Entity kind
- person
Record description
Mukul Goyal is the named security researcher on Parameter's October 28, 2026 ChatGPT shared-link exploit report. The report reconstructs a controlled path from a public conversation share into an HTML Preview and MathLive cross-frame message receiver, then into script running with the authenticated ChatGPT origin. It describes retrieval of a private conversation that had not been shared with the attacker.
The research is notable for its delivery progression. An early version required an App, while the later carrier combined a graph that installed the message listener with an automatically previewable HTML block in an ordinary share link. The report says the automatic variant was reproduced across accounts and that OpenAI confirmed fixes on October 26, before the public write-up. These statements come from the researcher's account, not a separately published independent regression test. The researcher profile links to the single underlying Case and the dated News explanation; it does not imply any verified mass exploitation, or infer unrelated employment or affiliations.