Researchers chain ChatGPT sandbox bugs to take over user accounts

Security researchers at Parameter Labs found a way to take over ChatGPT accounts by chaining several small flaws in how OpenAI isolates interactive content inside the chatbot. OpenAI has fixed the issue and paid a $5,000 bug bounty, according to a Parameter Labs writeup that developer Simon Willison linked to on October 31.

The flaw sat inside what OpenAI now calls HTML previews, a feature that runs user-generated code inside a locked-down iframe, a webpage embedded within a page. OpenAI uses the MathLive library to render math graphs, and MathLive ships its own on-screen keyboard that a sandboxed iframe can trigger in the main ChatGPT page by sending it a postMessage, a browser method for passing data between frames. The code that received those messages used innerHTML, a command that inserts raw HTML, to draw the keyboard.

Parameter Labs found that OpenAI never blocked other sandboxed frames, including HTML preview frames running arbitrary user code, from sending that same message. That let an attacker’s HTML preview insert its own HTML into the trusted parent page. Inserting HTML this way does not run script tags directly, but it let the attacker add a brand-new iframe that lacked the sandbox restrictions of the original one.

That still left OpenAI’s content security policy, a browser rule that limits where scripts can load from, blocking inline scripts and permitting script loads only from a short list of approved domains. One of those domains was YouTube. Parameter Labs found that YouTube’s oEmbed endpoint, used to fetch embeddable video information, could be made to reflect attacker-controlled JavaScript back in a form the browser would execute.

With code now running inside ChatGPT itself, the attacker could call OpenAI’s private APIs directly and pull data tied to the victim’s account, then send it out by loading an image whose URL encoded the stolen data. Parameter Labs says the end result was a single ChatGPT share link that, when opened by another logged-in user, could leak that user’s private data or act on their account without their knowledge.

Willison called the $5,000 bounty low given the severity of a bug that let one link silently compromise another person’s account. The writeup does not say whether the technique was used against real users before OpenAI closed it, and OpenAI has not published its own account of the incident. Whether other chatbots that run similar sandboxed, user-generated HTML artifacts carry the same kind of cross-frame messaging weakness is the question the disclosure leaves open for the rest of the industry to check.