How We Took Over ChatGPT Accounts

Why it matters

Security researchers at Parameter Labs uncovered a multi-step exploit chain that allowed takeover of ChatGPT accounts, prompting OpenAI to fix the flaw and pay a bug bounty. The vulnerability centered on ChatGPT's HTML preview feature, which displays user-generated interactive content in a sandboxed iframe meant to keep untrusted code away from OpenAI's APIs and private user data. The researchers found that the MathLive JavaScript library, used for graph support, exposed a postMessage handler in the parent page that inserted content via innerHTML. Because no mechanism restricted which frames could send those messages, code inside a sandboxed preview could inject HTML into the parent page and create an iframe without sandbox restrictions. OpenAI's content security policy blocked inline scripts, but a YouTube oEmbed endpoint could reflect executable JavaScript back into the page. With script execution achieved, an attacker could fetch private data and exfiltrate it, or act on a victim's behalf, simply by getting a signed-in user to visit a malicious share URL. The incident highlights how layered browser defenses can fail when combined in unexpected ways.