Parameter Labs chains MathLive, YouTube oEmbed to hijack ChatGPT accounts

The vulnerability sits in the artifacts pattern — the feature OpenAI once called Canvas and now presents as HTML previews — where interactive custom HTML apps run in a sandboxed iframe. Keeping that HTML tightly sandboxed is meant to stop untrusted code from reaching OpenAI APIs or private data. Parameter Labs' chain shows how a supporting library can widen that boundary: MathLive, used for graph support, includes a virtual keyboard that the parent page listens for via postMessage(), and the receiving code used innerHTML without preventing other sandboxed frames, including preview frames, from calling it.

From there, the attack bypassed OpenAI's CSP rules, which blocked inline scripts and allowed script loading from only a handful of domains, one of which was YouTube. The YouTube oEmbed endpoint could reflect JavaScript back in a way that executed it. Once JavaScript ran, fetching private user data from APIs and exfiltrating it via an image reference was trivial, according to the write-up.

The practical result was a share URL that could act against another signed-in user. OpenAI closed the hole and paid a $5,000 bug bounty, which Simon Willison called a bit cheap for a vulnerability this serious; that assessment is his opinion, not a stated policy of OpenAI.