How Attackers Took Over ChatGPT Accounts via a MathLive + YouTube CSP Exploit Chain
Simon Willison · rss · 2026-11-01
Simon Willison covers Parameter Labs' disclosure of a complex exploit chain against ChatGPT's sandboxed HTML previews (formerly Canvas): the MathLive keyboard in the parent page accepted postMessage() calls and used innerHTML, letting sandboxed iframes inject HTML—including a new iframe without sandbox restrictions. OpenAI's strict CSP only allowed scripts from a few domains, but the YouTube oEmbed endpoint could reflect JavaScript into execution. With JS on the ChatGPT page, attackers could fetch private API data and exfiltrate it via image references via crafted share links. OpenAI patched the hole and paid a $5,000 bounty, which Willison calls a bit cheap for such a serious vulnerability.
More from Models
- Claude Code rolls out bankable usage resets; $200-tier user still says quota not enough — lxfater · 2026-11-01
- Analyst maps OpenAI vs Anthropic coding race: Opus 5.5 sparks Anthropic revenue rebound — firstadopter · 2026-11-01
- DeepSeek V4.1 Flash clocks ~1038 tok/s live via Baseten inference — gajesh · 2026-11-01
- Guess which Halloween sign was one-shot by Gemini and which by Claude — tristanbob · 2026-11-01
- Banteg jokes Claude's 'sex-negative' refusals are 'deeply misaligned behavior' — banteg · 2026-11-01
- Byte-level analysis shows the alleged leaked DeepSeek V4.1 weights are fake — teortaxesTex · 2026-11-01