ChatGPT account takeover was a composition failure, not an auth flaw
petrusenko_max · x · 2026-10-31
A security analysis argues the ChatGPT account takeover was a composition failure, not a flaw in ChatGPT's auth itself:
- A sandboxed HTML preview and a graph's MathLive listener were each harmless alone but dangerous when chained together
- If MathLive had enforced origin checks, the attack chain would have been stopped
Takeaway: individually safe components can combine into an exploit, so integration points need strict origin validation.
More from Safety
- AI can now track exactly what you look at in a store — CodeByPoonam · 2026-10-31
- Gary Marcus reports from the Vatican: the Pope's five points on AI — GaryMarcus · 2026-10-31
- Anthropic research: Claude-generated datasets trigger stronger emergent misalignment — EvanHub · 2026-10-31
- Gary Marcus meets Pope Leo XIV: five AI principles and a critique of LLMs — Gary Marcus · 2026-10-31
- Sabine Hossenfelder quips AI may eat quantum computing's last reason to exist — coherence · 2026-10-31
- Scammers Target Andrew Ng, Keep Pitching After He Offers Fake Credentials — andrewgwils · 2026-10-31