How We Took Over ChatGPT Accounts
- ID
- 41651
- Status
- summarized
- Published
- 01 Nov 2026, 7:15 AM
- Fetched
- 01 Nov 2026, 8:12 AM
- Provider
- Simon Willison
- Category
- developer-ai
- Original URL
- https://simonwillison.net/2026/Oct/31/how-we-took-over-chatgpt-accounts/
- Source URL
- https://simonwillison.net/atom/everything/
Summary
- Score
- 8.0
- Created
- 01 Nov 2026, 8:12 AM
- Tags
- Audience
- developersvibe_codersai_agent_userssaas_founders
What happened
Parameter Labs documented a ChatGPT artifacts/HTML-preview exploit chain: MathLive's postMessage handler used innerHTML, letting a sandboxed preview inject an unsandboxed iframe, and CSP allowed YouTube's oEmbed endpoint to reflect executable JavaScript. That gave script execution inside ChatGPT, so a crafted share link could exfiltrate a signed-in user's private data via an image URL or take actions on their behalf. OpenAI fixed the hole and paid a $5,000 bug bounty.
Why it matters
If you build HTML preview, artifact, or share-link features, audit every parent-page postMessage listener and CSP allowlist before trusting iframe sandboxing: this chain used a virtual-keyboard handler and YouTube oEmbed as stepping stones to script execution. Validate message origin and shape, avoid innerHTML, and treat third-party endpoints that can reflect JavaScript as part of your attack surface.
Discussion angle
Which parent-page message handler or CSP allowlist entry in your own product would turn a harmless sandboxed preview into code execution?