Security researchers have demonstrated a ChatGPT account takeover vulnerability that allowed attackers to extract private conversations and execute commands on behalf of logged-in users. The attack chained multiple sandbox bypasses through the interface’s interactive preview feature before OpenAI patched the issue and awarded a 5,000-dollar bug bounty.
Key points
- Parameter Labs discovered an exploit chain targeting the interactive HTML preview feature previously known as Canvas.
- The flaw used the MathLive library to escape an isolated frame and bypassed content security rules through YouTube endpoints.
- Attackers could distribute a malicious shared chat link to extract personal account data and chat history silently.
- OpenAI fixed the vulnerability and awarded the researchers a 5,000-dollar payout through its bug bounty programme.
The research, published by Parameter Labs in a report titled How We Took Over ChatGPT Accounts, focused on the workspace for code and visual rendering. OpenAI provides HTML previews to display interactive web applications generated by the model. Because these rendered outputs execute untrusted code provided by the model or third-party inputs, modern web applications rely on sandboxed iframes to isolate them from authentication tokens and administrative controls.
If code inside an isolated frame escapes its enclosure, it can access the surrounding browser environment. In ChatGPT, the outer application context holds session tokens, conversation history, and access to internal application programming interfaces.
Breaking out of the preview sandbox
The researchers examined how the primary ChatGPT page communicates with nested preview frames. Modern browsers permit cross-frame communication only through explicit messaging interfaces, typically the postMessage protocol, to prevent cross-site scripting attacks.
OpenAI integrated the third-party MathLive JavaScript library into ChatGPT to render mathematical notation and interactive graphs. The library bundles its own virtual keyboard, which is drawn in the main document. To support the keyboard, the host page maintained an event listener designed to receive incoming messages from embedded components.
When the event listener processed incoming signals, it inserted content into the primary document using the innerHTML property. This handler failed to verify the origin of incoming messages. As a result, any frame on the screen, including an untrusted HTML preview frame, could send arbitrary markup into the parent document.
Direct assignment to innerHTML does not immediately run standard JavaScript script tags in modern browsers. To circumvent this defence, the researchers used the injection flaw to insert a secondary iframe into the top-level ChatGPT page, configuring the new frame without sandbox restrictions.
Bypassing Content Security Policy restrictions
Even with an unrestricted frame inside the parent document, the attackers encountered OpenAI’s Content Security Policy. A Content Security Policy restricts the origins from which a browser can load scripts, styles, and other external assets.
OpenAI’s configuration prohibited inline JavaScript execution entirely and restricted external script loading to a short list of approved domains. One of those permitted hostnames belonged to YouTube, which OpenAI included to support video embeds inside conversations.
The researchers observed that YouTube’s oEmbed API endpoint returned data that could be structured to reflect executable code. By pointing their unconfined iframe to the approved YouTube domain with crafted callback parameters, the team loaded JavaScript while adhering strictly to the host page’s allowlist.
Once malicious script execution ran within the origin of chatgpt.com, the code possessed identical privileges to the active user session. It could query internal backend endpoints, read full conversation logs, access linked accounts, or generate new messages without triggering security warnings.
Data exfiltration and shared links
With access established, extracting private data required a transmission path that avoided network filters. The researchers demonstrated exfiltration by appending encoded user data as query parameters to outbound image requests. The browser automatically requests the image URL, handing the victim’s data directly to a remote server under the attacker’s control.
The delivery mechanism relied on standard ChatGPT collaboration tooling. An attacker could craft a prompt that generated the malicious preview structure, then produce a public share URL using the platform’s native link-sharing tool.
When a logged-in ChatGPT user opened the shared conversation, the preview rendered automatically. The exploit chain triggered in the background without requiring the victim to click internal buttons or grant permissions.
OpenAI response and bounty payout
Parameter Labs reported the findings directly to OpenAI through the company’s coordinated disclosure process. OpenAI resolved the security flaw by updating the postMessage event handler, restricting message origins, and adjusting its asset security rules to prevent reflection techniques.
OpenAI paid the researchers 5,000 dollars through its vulnerability rewards programme. Security analysts tracking the disclosure argued the bounty was modest given the severity of unauthenticated data extraction on an application serving hundreds of millions of weekly active users.
The exploit highlights ongoing structural challenges as generative artificial intelligence platforms transition from text-only conversational interfaces into full execution environments. When software platforms mix arbitrary code rendering with privileged user sessions, sandbox escape chains remain an attractive target for security research.
