The vulnerability targeted ChatGPT's HTML previews, which run custom applications inside sandboxed iframes. Security researchers at Parameter Labs discovered that flawed postMessage communication handling via the MathLive library allowed attackers to escape this sandbox. By injecting an unsandboxed iframe and abusing an allowlisted YouTube endpoint to bypass security policies, the exploit achieved arbitrary code execution. OpenAI resolved the security issue after disclosure and awarded the researchers a bug bounty.
Key points
Sending a malicious share link enabled automatic exfiltration of a victim's private infor…: Sending a malicious share link enabled automatic exfiltration of a victim's private information via ChatGPT APIs.
OpenAI patched the sandboxing flaw after the research team privately disclosed the attack…: OpenAI patched the sandboxing flaw after the research team privately disclosed the attack vector.
The reporting security researchers received a five thousand dollar bug bounty payout from…: The reporting security researchers received a five thousand dollar bug bounty payout from OpenAI for the discovery.
Sources checked by our analysis pipeline: 1
31st October 2026 - Link Blog
How We Took Over ChatGPT Accounts (via) Parameter Labs describe an exploit they found against ChatGPT's implementation of the artifacts pattern (OpenAI used to call this "Canvas" but it looks like the latest revision is called HTML previews), where interactive custom HTML apps are displayed in a sandboxed iframe.
It's important that HTML in these stays tightly sandboxed to avoid untrusted code interacting with OpenAI APIs and accessing private data.
Parameter found quite a complex attack chain. OpenAI use the MathLive JavaScript library as part of their graph support, and that library includes its own virtual keyboard, which can be triggered in the parent page via postMessage()
from the sandboxed iframe.
That message receiving code uses innerHTML
, so anything that sends a message can add custom HTML to the parent - and there was no mechanism to prevent other sandboxed frames, including HTML preview frames, from calling that method.
This meant untrusted code in an iframe could insert HTML, and while innerHTML
doesn't directly execute script elements it could be used to inject…
An unreleased foundation model evaluation copy, captured near the end of pretraining without alignment tuning, has surfaced in public channels. The massive system reveals deep architectural details about frontier scaling efforts that were previously mentioned only in proprietary code comments. Its disclosure exposes sensitive technical configurations and weight data typically guarded by leading research organizations.
The benchmark milestone demonstrates how combining multiple specialized systems can eclipse individual top-tier competitors on rigorous software engineering assessments. By releasing project materials directly to the developer community, the creators are providing an open-source footprint for their collaborative architecture. This multi-agent strategy highlights a growing industry trend toward pooling model resources to conquer complex coding evaluations.
Community members on Hacker News recently flagged an unauthorized upload concerning proprietary artificial intelligence technology on an open machine learning repository. The development sparked immediate interest among developers before site administrators stepped in to suppress the shared material. Safety risks quickly overshadowed the leak claims after moderators detected malicious threats tied directly to the published link.