Do the Math: How We Took Over ChatGPT Accounts
Summary
The article details a chain of vulnerabilities in ChatGPT's Preview and cross-frame messaging that allowed an attacker to execute code in a victim's authenticated session via a public share link, enabling access to private conversations and backend APIs. It includes the exploit steps, how OpenAI fixed the issue, and defensive lessons about cross-origin messaging, sandboxing, and CSP as defense in depth.