Four-Step Exploit Chain Let Attackers Hijack ChatGPT Accounts

Parameter Labs disclosed a multi-step exploit chain against ChatGPT's HTML preview feature—the sandboxed iframe environment OpenAI uses to render HTML pages, React components, SVG images, Mermaid diagrams, and Vega charts directly inside the chat interface. The end result, as Simon Willison reported on October 31, 2026, was a shareable ChatGPT URL that, when opened by any signed-in user, could silently exfiltrate private account data or execute actions on that user's behalf. OpenAI patched the vulnerability and paid a $5,000 bug bounty.

The exploit illustrates that the security boundary separating generated content from an authenticated session is an infrastructure problem, not a model problem. As we covered in AI agent security fails on shared surfaces, not model logic, the threat surface for agent-generated content is defined by the rendering environment.

The attack chain: four compounding failures

Parameter Labs did not find a single bug. They found four distinct weaknesses that, chained together, defeated every layer of isolation ChatGPT's HTML preview relied on.

postMessage bridge to the parent page. OpenAI uses the MathLive JavaScript library for graph support. MathLive's virtual keyboard can be triggered from a sandboxed iframe by sending a postMessage() call to the parent page—a message receiver that existed in the parent document's scope, outside any sandbox.

innerHTML injection. The MathLive message-receiving code processes incoming content using innerHTML. Because ChatGPT had no mechanism preventing HTML preview iframes from triggering this listener, untrusted code inside a preview frame could inject arbitrary HTML into the parent page. innerHTML does not execute <script> tags directly, but it could inject a new <iframe> element without sandbox restrictions.

CSP bypass via YouTube oEmbed. OpenAI's Content Security Policy blocked inline scripts and restricted external script loading to a small allowlist of trusted domains. YouTube was on that allowlist. Parameter Labs found that the YouTube oEmbed endpoint could reflect JavaScript in a form the browser would execute, turning a trusted CDN entry into an XSS vector against ChatGPT's own origin.

Data exfiltration via image reference. Once arbitrary JavaScript executed in ChatGPT's parent context, fetching private user data from OpenAI's own APIs required no further privilege escalation—the attacker code ran with the victim's authenticated session. Exfiltrating that data required only constructing an image URL pointing to an attacker-controlled server, a technique that bypasses many network-level monitors.

What the sandbox was supposed to prevent

OpenAI's documentation states that code previews and code execution use "a sandboxed environment," with workspace admins controlling whether network access is available. The iframe sandbox model is designed to prevent cross-origin script access and interaction with the parent page. The MathLive postMessage bridge undermined that contract not because the sandbox was misconfigured, but because a trusted first-party library opened a deliberate communication channel that the attacker repurposed.

This is why the failure class is difficult to eliminate: sandboxing restricts what an iframe can do natively, but any intentional messaging interface between sandbox and parent reintroduces a controlled attack surface. The more capable the artifact environment—and ChatGPT's supports HTML, React components, SVG, Mermaid, and Vega charts, with optional network access—the larger that surface becomes.

AI Mastery analysis

The $5,000 bounty—flagged by Willison as underpriced for the severity—is worth examining on its own terms. A vulnerability that produces a weaponizable share URL requiring no victim interaction beyond clicking a link, affecting all signed-in ChatGPT users, sits in a risk tier normally associated with critical CVSS scores and substantially larger payouts. Bug bounty calibration for AI-specific attack surfaces has not kept pace with what these systems can do.

The deeper lesson is the one infrastructure isolation, not model guardrails, establishes as the correct security frame. Parameter Labs did not touch ChatGPT's model at any stage. The attack chain ran entirely through a JavaScript runtime, a third-party library's message interface, a CSP allowlist entry, and standard browser fetch behavior. Teams building on artifact-style rendering should audit every postMessage listener accessible from rendered frames, treat any trusted-domain entry on a CSP script-src as a potential reflection point, and weigh whether the capability uplift from rich artifact environments is worth the structurally larger parent-page attack surface it creates.

The Parameter Labs disclosure confirms a pattern that will recur as AI platforms expand what generated content can render and execute. Every library, endpoint, or messaging channel that bridges the boundary between model output and authenticated user context is a candidate attack surface—regardless of how tightly the sandbox itself is configured.

Sources

• Primary: Working with writing blocks and code blocks in ChatGPT | OpenAI Help Center
• Reported by: Simon Willison: How We Took Over ChatGPT Accounts