How We Took Over ChatGPT Accounts
Summary
Parameter Labs exposed a vulnerability in OpenAI ChatGPT's sandboxing that could allow untrusted iframe content to exfiltrate private user data or perform actions on behalf of signed-in users. The exploit leveraged the interaction between sandboxed iframes, postMessage, and content security policies, culminating in JavaScript execution via a YouTube oEmbed vector. OpenAI patched the issue and awarded a $5,000 bug bounty; the post underscores the need for strict sandboxing and careful cross-frame controls in AI chat interfaces.