{"data":{"id":"754a1ed8-d6fc-4cec-bfb3-d7b4c59ef817","title":"How We Took Over ChatGPT Accounts","summary":"Parameter Labs found an attack chain against ChatGPT's artifacts feature, where HTML previews run in a sandboxed iframe. A sandboxed frame could call a postMessage() handler in the parent page, used by the MathLive library's virtual keyboard, that writes via innerHTML, letting it inject an unsandboxed iframe. Abusing a YouTube oEmbed endpoint allowed by CSP reflected JavaScript that executed, so a crafted ChatGPT share URL could exfiltrate another signed-in user's private data or act on their behalf. OpenAI closed the hole and paid a $5,000 bug bounty.","solution":"OpenAI closed the hole. No further mitigation is stated in source.","labels":["security","safety"],"sourceUrl":"https://simonwillison.net/2026/Oct/31/how-we-took-over-chatgpt-accounts/","publishedAt":"2026-10-31T23:15:22.000Z","cveId":null,"cweIds":null,"cvssScore":null,"cvssSeverity":null,"severity":"medium","attackType":["prompt_injection","data_extraction"],"issueType":"news","affectedPackages":null,"affectedPackageNames":null,"affectedPackageRefs":null,"affectedVendors":["OpenAI"],"affectedVendorsRaw":["ChatGPT","OpenAI"],"classifierModel":"claude-haiku-5-5","classifierPromptVersion":"v4","summaryPromptVersion":"v2","headline":null,"headlinePromptVersion":null,"cvssVector":null,"attackVector":null,"attackComplexity":null,"privilegesRequired":null,"userInteraction":null,"exploitMaturity":null,"epssScore":null,"epssCheckedAt":null,"kevDateAdded":null,"advisoryAliases":null,"affectedPackagesSource":null,"affectedPackagesCheckedAt":null,"patchAvailable":null,"disclosureDate":"2026-10-31T23:15:22.000Z","fixReleasedAt":null,"daysToFix":null,"fixCheckedAt":null,"capecIds":null,"crossRefCount":0,"attackSophistication":"advanced","impactType":["confidentiality","integrity"],"aiComponentTargeted":"plugin","llmSpecific":true,"classifierConfidence":0.85,"researchCategory":null,"atlasIds":["AML.T0051"]}}