{"slug": "how-we-took-over-chatgpt-accounts", "title": "How We Took Over ChatGPT Accounts", "summary": "Security firm Parameter found an attack chain that let a crafted ChatGPT share URL exfiltrate a signed-in user's private data or take actions on their behalf when the link was opened. The chain abused MathLive's virtual keyboard, which ChatGPT's graph support loads, to inject HTML into the parent page via postMessage() and innerHTML from a sandboxed iframe, then bypassed OpenAI's Content Security Policy by reflecting JavaScript through the YouTube oEmbed endpoint. OpenAI closed the hole and paid a $5,000 bug bounty, which Parameter called \"a bit cheap for a vulnerability this serious.", "body_md": "[How We Took Over ChatGPT Accounts](https://www.parameter.ai/labs/we-found-a-gap-at-openai)\n\nIt's important that HTML in these stays tightly sandboxed to avoid untrusted code interacting with OpenAI APIs and accessing private data.\n\nParameter found quite a complex attack chain. OpenAI use the MathLive JavaScript library as part of their graph support, and that library includes [its own virtual keyboard](https://mathlive.io/mathfield/virtual-keyboard/), which can be triggered in the parent page via `postMessage()` from the sandboxed iframe.\n\nThat message receiving code uses `innerHTML`, so anything that sends a message can add custom HTML to the parent - and there was no mechanism to prevent other sandboxed frames, including HTML preview frames, from calling that method.\n\nThis meant untrusted code in an iframe could insert HTML, and while `innerHTML` doesn't directly execute script elements it could be used to inject a new iframe *without* sandbox restrictions.\n\nOpenAI’s CSP rules blocked inline scripts entirely, and only allowed script loading from a handful of domains, but one of those was YouTube - and the YouTube oEmbed endpoint could be used to reflect JavaScript back in a way that executed it.\n\nOnce the attack had JavaScript execution on ChatGPT, it was trivial to fetch private user data from APIs and exfiltrate it via an image reference.\n\nThe end result: you could create a ChatGPT share URL which, when visited by another signed-in user, could exfiltrate their private data or take actions on their behalf.\n\nOpenAI closed the hole and paid out a $5,000 bug bounty, which I think was a bit cheap for a vulnerability this serious.\n\nVia [Hacker News](https://news.ycombinator.com/item?id=50314699)\n\nTags: [iframes](https://simonwillison.net/tags/iframes), [javascript](https://simonwillison.net/tags/javascript), [sandboxing](https://simonwillison.net/tags/sandboxing), [security](https://simonwillison.net/tags/security), [xss](https://simonwillison.net/tags/xss), [openai](https://simonwillison.net/tags/openai), [chatgpt](https://simonwillison.net/tags/chatgpt), [content-security-policy](https://simonwillison.net/tags/content-security-policy)", "url": "https://wpnews.pro/news/how-we-took-over-chatgpt-accounts", "canonical_source": "https://simonwillison.net/2026/Oct/31/how-we-took-over-chatgpt-accounts/", "published_at": "2026-10-31 23:15:22+00:00", "updated_at": "2026-10-31 23:20:39.970963+00:00", "lang": "en", "topics": ["artificial-intelligence", "ai-products", "ai-safety"], "entities": ["OpenAI", "ChatGPT", "Parameter", "MathLive", "YouTube", "Hacker News"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/how-we-took-over-chatgpt-accounts", "markdown": "https://wpnews.pro/news/how-we-took-over-chatgpt-accounts.md", "text": "https://wpnews.pro/news/how-we-took-over-chatgpt-accounts.txt", "jsonld": "https://wpnews.pro/news/how-we-took-over-chatgpt-accounts.jsonld"}}