# Parameter Labs details exploit that could take over ChatGPT accounts

published: 2026-11-01T00:05:28.351Z
topic: identity
breaking: true
source: https://simonwillison.net/2026/Oct/31/how-we-took-over-chatgpt-accounts/
url: https://aiagentnews.io/stories/parameter-labs-details-exploit-that-could-take-over-chatgpt-accounts

Parameter Labs says it found a chain of flaws in ChatGPT's sandboxed HTML previews that let a crafted share link reach another signed-in user's private data. OpenAI has closed the hole and paid a $5,000 bug bounty for it.

The attack targets the artifacts feature, which OpenAI once called Canvas and now appears to name HTML previews. These interactive HTML apps run in a sandboxed iframe, and the researchers found a way around that isolation. OpenAI's graph support uses the MathLive library, whose virtual keyboard can be triggered by postMessage() from a sandboxed frame. The handler for that message uses innerHTML, and nothing stopped other sandboxed frames from calling it.

That let untrusted code insert HTML into the parent page, including an iframe without sandbox restrictions. ChatGPT's content security policy blocked inline scripts and allowed scripts from a few domains, one of which was YouTube. The YouTube oEmbed endpoint could reflect JavaScript so that it ran, giving the attacker script execution on ChatGPT.

From there, the attacker could fetch private user data from ChatGPT's APIs and send it out through an image reference. The result was a ChatGPT share URL that, when opened by another signed-in user, could leak their data or take actions for them. OpenAI fixed the issue and paid a $5,000 bounty, which Simon Willison calls cheap for a flaw this serious.

## Why it matters if you build agents

Teams that render model-generated HTML or let users share agent output should treat sandboxed iframes as a boundary to test, not a guarantee. A message handler that writes untrusted content with innerHTML can undo that isolation, and a permissive content security policy that allows a widely hosted script endpoint can be enough to run code. Review which script hosts your pages can load and check that message handlers validate their senders.