Parameter Labs described an exploit chain that allowed attackers to take over ChatGPT accounts through shared links, according to a report by Simon Willison on 31 October 2026.reported The flaw existed in the implementation of interactive HTML previews, formerly known as Canvas, which run inside sandboxed iframes.
The claim
Researchers found that the MathLive JavaScript library, used for graph support, included a virtual keyboard triggerable from sandboxed iframes via postMessage. The receiving code used innerHTML to process these messages, allowing untrusted code to insert custom HTML into the parent page without restrictions.
The response
OpenAI addressed the issue by closing the vulnerability and paying a $5,000 bug bounty.reported Simon Willison noted in his report that this payout seemed low for a vulnerability of such seriousness, which allowed full account takeover via shared URLs.
The practical upshot
The exploit relied on a complex chain where injected HTML could create new iframes without sandbox restrictions. Although Content Security Policy blocked inline scripts, attackers leveraged YouTube’s oEmbed endpoint to reflect and execute JavaScript, bypassing domain restrictions.
Claims versus evidence
The source material confirms the technical mechanism: postMessage triggered innerHTML injection via MathLive, enabling iframe escape. Evidence includes the successful creation of share URLs that exfiltrated data from signed-in users. Limits acknowledged include the reliance on YouTube’s oEmbed endpoint for script execution, as inline scripts were blocked. The claim of account takeover is supported by the researchers' demonstration, though the scope beyond shared links remains unspecified in the report.
Why it matters
- Product teams using sandboxed iframes must audit third-party libraries like MathLive for postMessage handlers that use innerHTML, as they can bypass sandbox isolation.
- The exploit demonstrates that Content Security Policy alone is insufficient if trusted domains (like YouTube) can reflect executable JavaScript through oEmbed endpoints.
- Shared URLs in AI applications can become attack vectors for account takeover if preview mechanisms allow untrusted code to interact with parent page APIs.
- Bug bounty payouts may not reflect the true risk of vulnerabilities that enable full account compromise, suggesting teams should assess impact independently.
Topics: OpenAI, ChatGPT, security, sandboxing, bug bounty
Updated
Story timeline
- 31 Oct 2026 Do the math: How we took over ChatGPT accounts
- 31 Oct 2026 How We Took Over ChatGPT Accounts
Ask the article
Local keyword search of this article; no generated answers.Did this article give you the evidence you needed?
Your choice stays on this device. No public tally.Questions readers ask
How did the ChatGPT sandbox escape work?
Untrusted code in an iframe used postMessage to trigger MathLive’s virtual keyboard, which used innerHTML to inject HTML into the parent page, allowing new unrestricted iframes.
Was the vulnerability patched?
Yes, OpenAI closed the hole and paid a $5,000 bug bounty to Parameter Labs researchers who reported the exploit chain.
What role did YouTube play in the attack?
YouTube’s oEmbed endpoint allowed attackers to reflect JavaScript back into the page, bypassing OpenAI’s Content Security Policy that blocked inline scripts.
Connected stories
Reading receipt
- Untrusted iframe code could inject HTML into the parent page via postMessage.
- The exploit chain used YouTube's oEmbed endpoint to execute reflected JavaScript.
- OpenAI patched the vulnerability and paid a $5,000 bug bounty to researchers.