Skip to content
Trending storyDeveloping

Parameter Labs' ChatGPT HTML preview exploit could take over user accounts

1 article1 sourcesince Oct 31Last article 2h ago ·

Overview

AISummary of 1 article

Parameter Labs describes an exploit in ChatGPT's HTML preview sandbox that chained a MathLive virtual keyboard message handler with a YouTube oEmbed endpoint to run JavaScript.

According to the report, a signed-in user who opened a malicious share URL could have had private data fetched and exfiltrated through an image reference, enabling account takeover. OpenAI fixed the issue and paid a $5,000 bug bounty. Simon Willison, who reported on the disclosure, calls that payment cheap for a vulnerability of this severity.

Written by AI from the articles below · updated Oct 31, 8:12 PM ET

Check the sources:

Latest developmentOct 31, 7:15 PM ET
Parameter Labs details how a ChatGPT HTML preview exploit could take over accounts

Article timeline

The articles in this story. Times are ET.

Oct 31
  1. Simon WillisonBlog
    Parameter Labs details how a ChatGPT HTML preview exploit could take over accounts

    AIParameter Labs describes an exploit against ChatGPT's HTML preview sandbox that chained a MathLive virtual keyboard message handler with a YouTube oEmbed endpoint to run JavaScript. The attack could fetch private user data and exfiltrate it through an image reference when a signed-in user visited a malicious share URL. OpenAI fixed the hole and paid a $5,000 bug bounty, which Simon Willison calls cheap for a vulnerability this serious.

Heat Trend

Not enough continuous observations to show a trend yet.