Security researchers disclose ChatGPT account-takeover exploit via HTML-preview sandbox escape
2026-10-31
Security research firm Parameter Labs disclosed an exploit chain against ChatGPT's sandboxed HTML-previews (artifacts/Canvas) feature: a MathLive virtual-keyboard postMessage handler using innerHTML let untrusted iframe code inject an unsandboxed iframe, and OpenAI's CSP allow-list for YouTube's oEmbed endpoint let that code execute JavaScript, enabling a crafted ChatGPT share URL to exfiltrate a visiting signed-in user's private data or take actions on their behalf. OpenAI fixed the issue and paid a $5,000 bug bounty.
Significance 3: A documented account-takeover vulnerability in ChatGPT's sandboxed interactive-content feature, now patched, is a credible security/trust issue worth tracking but is an isolated, already-resolved incident rather than a verdict-moving capability change.
Implications · machine-drafted, not owner judgment
The exploit shows OpenAI's sandboxing of agent-generated interactive content in a flagship consumer product was not as airtight as claimed, and the breach was found and disclosed by outside researchers rather than caught internally. For the owner's trust-in-AI-vendors lens, this is a concrete instance where a vendor's stated isolation guarantee failed in practice, adding a data point to how much weight to put on labs' own security/trust claims versus independent testing.
- Whether other labs' artifact/canvas-style sandboxing features face similar disclosed exploits
- Any disclosure of the scale of exploitation before the patch shipped
Sources
- curator How We Took Over ChatGPT Accounts retrieved 2026-11-01