ChatGPT帳號接管漏洞評測：分享連結開啟4.5秒淪陷 | ChatGPT Account Takeover Review: One Link, 4.5-Second Hijack

By Kit 小克 | AI Tool Observer | 2026-11-01

🇹🇼 ChatGPT帳號接管漏洞評測：分享連結開啟4.5秒淪陷

ChatGPT帳號接管漏洞在10月被資安團隊Parameter揭露：只要點開一個看起來正常的ChatGPT公開分享連結，不用安裝App、不用貼程式碼、不用登入，約4.5秒內，攻擊者就能以你的帳號身分讀取私人對話、偷走登入憑證，等同完全接管帳號。這起漏洞已於10月26日修復，但攻擊鏈本身值得每個用AI工具做開發的人看一遍。

ChatGPT帳號接管是怎麼發生的

攻擊鏈串了五個環節，聽起來複雜，拆開看其實很直白：

攻擊者建立一個公開分享對話，裡面放一張真的數學圖表，順便夾帶惡意的HTML Preview
圖表會載入MathLive這個數學輸入元件，而它在主頁面裝了一個訊息監聽器(postMessage listener)
Preview對MathLive發送未驗證來源的跨框架訊息，MathLive沒檢查訊息是誰送的就照單全收
MathLive被騙去渲染攻擊者給的HTML，裡面藏了一個沒有沙盒限制的iframe
這個iframe呼叫YouTube的oEmbed端點，用動了手腳的JSONP callback，繞過CSP（內容安全政策）執行任意JavaScript，而且是以chatgpt.com的身分執行

研究團隊表示，受害者不需要安裝App、加入Project、貼程式碼，或打開開發者工具，打開分享連結就是唯一需要的動作。這正是ChatGPT帳號接管最嚇人的地方，完全沒有使用者操作失誤可言。

時間線：從發現到修復只花9天

10月13-17日：研究團隊重現並在自己帳號間測試攻擊鏈
10月18日：回報給OpenAI的漏洞獎勵計畫
10月21日：嚴重等級被提升為P1
10月26日：確認修復
獎金：OpenAI支付5,000美元

對一般用戶和開發者意味著什麼

對一般用戶來說，這個洞已經補好了，不需要做任何事，但它提醒我們：AI產品裡任何「分享連結」功能，本質上都是在把你的session暴露給陌生人點開的網頁。下次看到「某人分享了一個對話給你」，多一分警覺不是壞事。

對開發者來說，這才是重點：如果你的產品裡用了postMessage做跨框架通訊（這在嵌入第三方元件、圖表庫、數學渲染器時很常見），務必檢查訊息來源(event.origin)有沒有驗證。MathLive這次就是栽在「監聽所有來源的訊息」這個常見疏忽上。花20分鐘把專案裡的postMessage監聽器抓出來檢查一輪，比事後擦屁股划算太多。

結語

這次ChatGPT帳號接管事件沒有造成已知的真實損害，OpenAI反應夠快，9天內關閉破口。但它示範了一個重要教訓：AI產品的攻擊面不只在模型本身，分享功能、嵌入元件、第三方API整合，每一個都可能是破口。好不好用，試了才知道。

🇺🇸 ChatGPT Account Takeover Review: One Link, 4.5-Second Hijack

A ChatGPT account takeover vulnerability disclosed by security team Parameter in October let an attacker read a victim's private conversations and hijack their session in roughly 4.5 seconds, triggered by nothing more than clicking an ordinary-looking public ChatGPT share link. No app install, no pasted code, no login required. OpenAI patched it on October 26, but the attack chain is worth understanding for anyone building with AI tools.

How the ChatGPT Account Takeover Worked

The chain strung together five steps that sound complex but are simple once unpacked:

An attacker creates a public shared conversation containing a genuine math graph, plus a malicious HTML Preview tucked alongside it
The graph loads MathLive, a math input library, which installs a postMessage listener on the main ChatGPT page
The Preview sends unverified cross-frame messages to MathLive, which accepts them without checking the sender's origin
MathLive is tricked into rendering attacker-supplied HTML containing an unsandboxed iframe
That iframe calls YouTube's oEmbed endpoint with a manipulated JSONP callback, bypassing the Content Security Policy to run arbitrary JavaScript as chatgpt.com

According to the researchers, the victim did not need to install an app, join a project, paste code, or open developer tools. Opening the shared link was the only required action. That is what makes this ChatGPT account takeover so unsettling, there is no user mistake to point to.

Timeline: Nine Days From Discovery to Fix

Oct 13-17: Chain reproduced and tested between accounts the researchers controlled
Oct 18: Reported to OpenAI's bug bounty program
Oct 21: Severity escalated to P1
Oct 26: Confirmed fixed
Bounty paid: $5,000

What It Means for Users and Developers

For regular users, there is nothing to do, the hole is closed. But it is a reminder that any share link feature in an AI product is, structurally, exposing your session to a page a stranger controls. A little extra caution the next time someone sends you a shared conversation is not paranoia.

For developers, this is the real takeaway: if your product uses postMessage for cross-frame communication, common when embedding third-party widgets, chart libraries, or math renderers, verify event.origin on every listener. MathLive's bug came from the classic mistake of accepting messages from any sender. Spending twenty minutes auditing every postMessage listener in your codebase is far cheaper than cleaning up after this kind of chain.

Bottom Line

This ChatGPT account takeover left no known real-world victims, OpenAI closed the hole in nine days. But it is a clear demonstration that an AI product's attack surface is not just the model; sharing features, embedded widgets, and third-party API integrations are all part of it. 好不好用，試了才知道，you only know if it holds up once you have actually tried it.

Sources / 資料來源

延伸閱讀 / Related Articles

AI 工具觀察站 — 每日精選 AI Agent 與工具趨勢
AI Tool Observer — Daily curated AI Agent & tool trends

Claude Code 實測：AI 幫你寫程式到底行不行？ | Claude Code Review: Can AI Really Code for You?

3月 26, 2026

閱讀完整內容

搜尋此網誌

AI小貼士