A math-keyboard library, a YouTube callback and one share link opened ChatGPT accounts

Four reasonable features that add up to account takeover

According to Parameter's write-up, the ChatGPT HTML Preview runs in an isolated frame. But a math-keyboard library called MathLive, loaded by an interactive graph in the same conversation, listened for messages on the main page without checking who sent them, and the Preview could message it. The library accepted raw HTML as layout data and inserted it into the page unsanitized, which created an unsandboxed frame that inherited the chatgpt.com identity.

Content Security Policy blocked inline scripts but allowed YouTube, and a YouTube oEmbed callback endpoint returned attacker-supplied code that ran in that frame. From there the code could list recent conversations, read a private one and send data to an outside server.

The timeline is short. The team submitted on October 18, OpenAI reproduced it on October 21 and raised severity from P2 to P1, fixed both web frontends by October 26, and paid a $5,000 bounty.

The price tag

"only $5000 for this, lmao. It should be $50k out of pure shame. If they don't make these things hurt just a little they're never going to take following best practices seriously enough." — a commenter on the bounty

Another commenter predicted that the next researcher won't bother reporting and will sell to a broker instead.

The researchers' own reputation

The most interesting replies were about Parameter itself.

"this company randomly reached out disclosing a vulnerability to us (test environment, synthetic tenant). on the one hand, thank you, it's patched. on the other - we do not have a bug bounty program and this is not welcome." — a commenter whose company was contacted by the firm

A second commenter, who said Parameter ran an unsolicited pentest on his employer, called the team a joke and noted that the firm's homepage leads with "Backed by YC".

A readability complaint with a real point

One reader said he couldn't tell how the researchers controlled the share content in the first place, since a share's only author-controlled input is the prompt text, and the write-up's JSONP section explains the mechanism without showing how it was bypassed. The article is the only public account of the chain, so that gap stays open.