Parameter Labs disclosed a complex attack chain against ChatGPT's HTML preview artifacts that allowed sandbox escape, JavaScript execution, and exfiltration of private user data via crafted share URLs. OpenAI patched the flaw and paid a $5,000 bug bounty, which was criticized as too low for such a severe vulnerability.
# How We Took Over ChatGPT Accounts
Source: [https://simonwillison.net/2026/Oct/31/how-we-took-over-chatgpt-accounts/](https://simonwillison.net/2026/Oct/31/how-we-took-over-chatgpt-accounts/)
31st October 2026 \- Link Blog
**[How We Took Over ChatGPT Accounts](https://www.parameter.ai/labs/we-found-a-gap-at-openai)**\([via](https://news.ycombinator.com/item?id=50314699)\) Parameter Labs describe an exploit they found against ChatGPT's implementation of the artifacts pattern \(OpenAI used to call this "Canvas" but it looks like the latest revision is called[HTML previews](https://help.openai.com/en/articles/20001246-working-with-writing-blocks-and-code-blocks-in-chatgpt)\), where interactive custom HTML apps are displayed in a sandboxed iframe\.
It's important that HTML in these stays tightly sandboxed to avoid untrusted code interacting with OpenAI APIs and accessing private data\.
Parameter found quite a complex attack chain\. OpenAI use the MathLive JavaScript library as part of their graph support, and that library includes[its own virtual keyboard](https://mathlive.io/mathfield/virtual-keyboard/), which can be triggered in the parent page via`postMessage\(\)`from the sandboxed iframe\.
That message receiving code uses`innerHTML`, so anything that sends a message can add custom HTML to the parent \- and there was no mechanism to prevent other sandboxed frames, including HTML preview frames, from calling that method\.
This meant untrusted code in an iframe could insert HTML, and while`innerHTML`doesn't directly execute script elements it could be used to inject a new iframe*without*sandbox restrictions\.
OpenAI’s CSP rules blocked inline scripts entirely, and only allowed script loading from a handful of domains, but one of those was YouTube \- and the YouTube oEmbed endpoint could be used to reflect JavaScript back in a way that executed it\.
Once the attack had JavaScript execution on ChatGPT, it was trivial to fetch private user data from APIs and exfiltrate it via an image reference\.
The end result: you could create a ChatGPT share URL which, when visited by another signed\-in user, could exfiltrate their private data or take actions on their behalf\.
OpenAI closed the hole and paid out a $5,000 bug bounty, which I think was a bit cheap for a vulnerability this serious\.
Parameter Labs researchers disclosed a cross-frame message passing flaw that chained ChatGPT's HTML Preview sandbox with MathLive's unvalidated postMessage listener, letting a shared conversation run attacker JavaScript in a victim's signed-in session and take over their account. OpenAI fixed the P1 issue on October 26, and no user action beyond opening the link was required.
Researchers at the Objective-See Foundation discovered a 'insanely trivial' vulnerability in the macOS ChatGPT app that could have let attackers take over the app, access chat logs, and issue commands as legitimate OpenAI software. OpenAI publicly acknowledged the flaw and fix in its changelog on September 25.
OpenAI took ChatGPT offline on March 20 due to a bug in an open-source library that exposed chat history titles and payment information to some users. The incident affected 1.2% of ChatGPT Plus subscribers, revealing partial credit card details and personal information during a nine-hour window, though full credit card numbers were never exposed.
Security researcher Simcha Kosman discusses his team's Black Hat USA 2026 research on breaking out of ChatGPT's secure sandbox, highlighting vulnerabilities in container isolation and AI supervision through attack chains.
Hackers are poisoning AI systems like ChatGPT and Gemini with malicious content to trick users into scams, highlighting critical vulnerabilities in AI's reliance on web data.