OpenAI fixed ChatGPT sandbox-escape chain that could take over accounts

ChatGPT’s graph and HTML Preview features formed the exploit chain

Parameter Labs said the chain began with a graph and an HTML Preview. MathLive accepted a state-changing message without verifying which frame sent it, while the message format allowed raw HTML as keyboard-layout data.

Parameter Labs said it reproduced the automatic preview-opening path three times in a separate account, including after a hard refresh. The alert appeared after roughly 4.5 seconds in those tests.

Opening a shared link was the only victim action

Parameter Labs said an attacker could create a malicious conversation, publish it through ChatGPT’s normal sharing feature and send the link to another user. The victim did not need to install an app, join a project, paste code or open developer tools.

The researchers said the resulting code could enumerate the victim’s conversation list, retrieve content from a private conversation that had never been shared with the attacker and send data from that conversation to an external server.

OpenAI reproduced the proof and awarded a $5,000 bounty

Parameter Labs said OpenAI reproduced both the JavaScript execution and the private-conversation proof. It said OpenAI confirmed that both web frontends rejected the reported messages and awarded a total bounty of $5,000.

Parameter Labs published its report on Oct 28. Simon Willison published a separate report on Oct 31 and said OpenAI closed the vulnerability and paid a $5,000 bug bounty.

Parameter Labs said OpenAI classified the report as P1 and fixed the issue on Oct 26. OpenAI confirmed that both ChatGPT web frontends rejected the reported messages and resolved the issue.

Parameter Labs recommended that postMessage receivers authenticate both event.origin and event.source before accepting state-changing instructions, and keep dynamically created documents sandboxed when untrusted frames can influence their content.