Parameter Labs Discovers Account Takeover Vulnerability in ChatGPT

Summary

Parameter Labs discovered a multi-step exploit in ChatGPT's sandboxed HTML preview (artifacts) feature. This exploit allowed unsafe iframe code to escape the sandbox, execute JavaScript on the main page, and exfiltrate private data from logged-in users via a shared URL. OpenAI patched the vulnerability and paid a $5,000 bug bounty.

Why it matters

The vulnerability turned an innocent-looking ChatGPT share link into a full account takeover vector. This means that any user who opens the link while logged in could have their data stolen or actions performed on their behalf. The incident highlights how a single unsafe innerHTML usage in a third-party library (MathLive), combined with a permissive CSP allowlist (YouTube oEmbed), can break the entire sandbox model. It underscores that arbitrary user-generated HTML embedded in AI product interfaces represents a high-value attack surface requiring strict isolation guarantees.

Highlights

• Attack chain: postMessage → innerHTML injection → non-sandboxed iframe → YouTube oEmbed JS reflection → data exfiltration via image tag
• CSP allowed script loading from YouTube. YouTube's oEmbed endpoint reflected executable JavaScript, becoming the final escape point.
• OpenAI paid a $5,000 bug bounty. Simon Willison noted that this amount was 'a bit cheap' given the severity of the vulnerability.

Critical take

Although the article is technically detailed, it reads like a single researcher's blog post lacking independent verification or a CVE reference. Additionally, the $5,000 payout, characterized as low, raises questions about whether OpenAI's internal risk assessment truly aligns with the real-world impact of a shareable account takeover URL.