Source time Edition date
IndustrySimon Willison
How We Took Over ChatGPT Accounts
我们如何接管 ChatGPT 账户
A researcher's walkthrough of taking over ChatGPT accounts is worth reading because it forces a choice between shipping features fast and holding stricter session controls until the risks are patched.
Judgment
OpenAI's product and security leads must decide whether to keep HTML previews broadly enabled while adding origin checks and narrowing the CSP allowlist, or temporarily restrict postMessage-driven features until the iframe boundary is re-audited.
Basis
Parameter Labs describes an exploit chain against ChatGPT's HTML previews: a sandboxed iframe can trigger MathLive's virtual keyboard via postMessage(), and the parent-page handler uses innerHTML, allowing injection of a new iframe without sandbox restrictions. OpenAI's CSP blocked inline scripts but allowed YouTube, whose oEmbed endpoint reflected JavaScript that executed on ChatGPT. From there, Parameter Labs could fetch private user data and exfiltrate it via an image reference, or take actions as a signed-in user. Simon Willison calls the $5,000 bug bounty "a bit cheap for a vulnerability this serious." The mechanism is a boundary failure between untrusted preview content and privileged parent-page APIs, not a single missing check.
- Sandboxed HTML previewpostMessage()
- MathLive postMessageinnerHTML
- innerHTML injects iframeCSP allowlist
- YouTube oEmbed JSimage ref
- Exfil via image
Unclear The source does not say whether OpenAI added origin validation to the MathLive postMessage handler, removed YouTube oEmbed from the CSP allowlist, or audited other libraries with similar parent-page messaging.
Next Check OpenAI's HTML previews release notes and Parameter Labs' follow-up for whether the MathLive handler now validates origin and whether YouTube oEmbed remains CSP-allowed.