How We Took Over ChatGPT Accounts

Parameter Labs found a complex attack chain against ChatGPT's HTML preview sandbox: a MathLive virtual-keyboard message handler used innerHTML without origin checks, letting untrusted iframe code inject an unsandboxed iframe, and YouTube's oEmbed endpoint, one of the few CSP-allowed script sources, reflected JavaScript to gain execution. A malicious share URL visited by a signed-in user could then exfiltrate private data or act on their behalf. OpenAI has closed the hole and paid a 5,000 dollar bounty, which the author calls cheap for a flaw this serious, a reminder that even tightly sandboxed AI app surfaces need strict message-origin checks.

• Simon Willison2026-10-31 23:15