The Numbers Behind Our Takeover of ChatGPT Accounts
openai
| Source: Mastodon | Original article
Researchers reveal a technique that bypasses security to hijack ChatGPT accounts.
Parameter Labs has revealed a critical flaw that let attackers hijack any ChatGPT account simply by sending a victim a shared‑conversation link. In a report titled “Do the Math: How We Took Over ChatGPT Accounts” published on October 28, 2026, the research team described a multi‑step chain that bypassed ChatGPT’s sandbox and content‑security policy (CSP). The exploit leverages the platform’s “HTML previews” (formerly called Canvas) to load a malicious MathLive keyboard library that listens for postMessage events from any sender. When a user opens the shared link, the library runs inside a sandboxed iframe that inherits the chatgpt.com origin, then uses a YouTube oEmbed CSP bypass to extract the session token, granting the attacker full control of the authenticated session.
OpenAI patched the vulnerability on October 26, 2026 and awarded the researchers a $5 000 bounty, echoing a recent $5 000 reward for a separate code‑execution bug reported to the company. The discovery sparked discussion on Hacker News, where the post garnered 284 points and over a hundred comments, underscoring community concern over the ease of account takeover.
The flaw matters because it demonstrates how a seemingly innocuous shared link can become a weapon for credential theft, data exposure and unauthorized use of paid ChatGPT resources. It also raises questions about the robustness of OpenAI’s iframe sandboxing and third‑party content handling.
Going forward, observers will watch OpenAI’s broader security roadmap, including any additional hardening of the HTML preview feature and the rollout of stricter CSP rules. The episode may also prompt other AI service providers to reassess how they embed interactive content, and could spur further bounty‑program activity aimed at uncovering similar cross‑origin attack vectors.
Sources
Back to AIPULSEN