HTML exploit lets attackers take over ChatGPT accounts

On 31st October 2026, Parameter Labs revealed an exploit in ChatGPT's HTML preview system. The vulnerability stemmed from how interactive HTML apps were displayed in sandboxed iframes. This design allowed malicious code to bypass security measures and access user data. The exploit was part of a broader attack chain involving the MathLive JavaScript library. OpenAI's implementation of the artifacts pattern, previously called 'Canvas,' was found to be vulnerable in its latest iteration.

The HTML preview feature was intended to securely render interactive content within ChatGPT. However, the sandboxing mechanism failed to prevent untrusted code from interacting with OpenAI APIs. This created a pathway for attackers to access private user data. Parameter Labs detailed the exploit in a blog post, highlighting the complexity of the attack chain. The vulnerability was discovered through a combination of code analysis and testing of the HTML rendering system.

The exploit involved a specific flaw in how ChatGPT handled HTML content. Parameter Labs identified that the sandboxing was not sufficient to block malicious scripts from executing. This allowed attackers to inject code that could access user accounts. OpenAI acknowledged the issue and closed the vulnerability. The company awarded a $5,000 bounty for the report, though some experts considered the payout low given the severity of the flaw.

The vulnerability exposed a critical weakness in ChatGPT's security infrastructure. Attackers could potentially use the exploit to gain unauthorized access to user accounts. The flaw also raised concerns about the reliability of sandboxing mechanisms in AI platforms. The incident highlighted the need for more rigorous security testing in AI systems. The exploit's discovery underscores the importance of continuous monitoring and updates to prevent similar vulnerabilities.

The incident has broader implications for AI security. It demonstrates how even well-intentioned design choices can introduce critical flaws. The exploit's complexity suggests that more sophisticated attacks may be possible. The vulnerability has prompted a reevaluation of security practices in AI development. The incident serves as a cautionary tale for developers and companies relying on similar systems.