Skip to content

Back to the catalog

simonwillison.netarticle

How We Took Over ChatGPT Accounts

Simon Willison summarises Parameter Labs' ChatGPT account takeover chain against the HTML previews (formerly Canvas) sandboxed iframe. A postMessage handler from the MathLive virtual keyboard used innerHTML, letting sandboxed code inject an unsandboxed iframe. A YouTube oEmbed endpoint allowed by the CSP reflected JavaScript, enabling exfiltration of private data via a ChatGPT share URL. OpenAI fixed it and paid a $5,000 bounty.

TL;DR Summarises a chained ChatGPT exploit: sandboxed iframe postMessage to innerHTML injection, CSP bypass through YouTube oEmbed, and account data exfiltration.
Open original ↗

Organisations named here

  • OpenAI
  • Parameter Labs

Technologies named here

  • ChatGPT
  • YouTube
  • JavaScript
  • MathLive
  • YouTube oEmbed endpoint

Techniques named here

  • Sandbox escape
  • DOM-based XSS
  • Content Security Policy bypass
  • Cross-site scripting via innerHTML injection
  • Data exfiltration via image reference
  • postMessage() abuse
  • Sandbox escape via injected iframe

Concepts named here

  • Artifacts pattern
  • Attack chaining
  • Bug bounty payout
  • Iframe sandboxing

Also named here

  • Simon Willison

Related in AppSec