# Exploiting ChatGPT Sandbox via Cross-Frame Message Injection Researchers bypassed ChatGPT security to execute arbitrary code via public conversation links. - **Source:** [Hacker News](https://news.ycombinator.com) - **Published:** 2026-10-31 - **Topic:** [Software & Engineering](https://brifing.si/c/engineering) - **Original article:** - **On Brifing:** https://brifing.si/s/90216e06-1a58-4e9e-9e05-953ae0d2bb61 ## The Sandbox Escape Mechanism In October 2026, researchers discovered a critical vulnerability allowing attackers to take over ChatGPT accounts. By bypassing content security policies, they turned public conversation shares into malicious JavaScript execution. Victims only needed to open a link, granting the attacker full access to their authenticated web session without any additional user interaction. ## Chain of Vulnerable Features The exploit relied on two seemingly harmless features: HTML Preview and interactive graphs. While the Preview was isolated in a restricted frame, the graph loaded a math library called MathLive. This library installed a message listener on the main page, creating an unintended communication bridge between the restricted frame and ChatGPT. ## Exploiting the MathLive Listener The MathLive listener accepted messages to update virtual keyboard layouts without verifying the sender's origin. Attackers sent messages to replace the keyboard layout with malicious HTML. Because the listener lacked origin validation, it accepted these instructions from any web address, effectively allowing the attacker to inject arbitrary content into the main page. ## Bypassing Content Security Policy Inserting HTML via innerHTML did not immediately execute JavaScript due to strict Content Security Policy rules. The researchers bypassed this by using an unsandboxed iframe with the srcdoc attribute. This created a new document inheriting the chatgpt.com origin, allowing them to load external scripts that were permitted by the existing policy. ## Leveraging YouTube for Execution The exploit utilized YouTube's oEmbed endpoint to execute code. Since YouTube was an allowed source in ChatGPT's CSP, the researchers used a JSONP-style callback to run their payload. By appending a void statement to the response, they neutralized error objects and successfully executed arbitrary JavaScript within the victim's authenticated ChatGPT session. ## Automated Attack Delivery The researchers packaged the entire exploit chain into a single public conversation share. When a victim opened the link, the payload automatically triggered the MathLive message sequence. This required no installation, project membership, or developer tool usage, making the attack highly effective and simple to distribute via social media or email. ## Data Theft and API Access Once the JavaScript executed as chatgpt.com, it gained full access to the victim's authenticated APIs. The payload enumerated recent conversations and retrieved content from private chats that were never shared. This demonstrated a practical cross-user data-theft primitive, where the attacker could read sensitive information and perform actions on the victim's behalf. ## Proof of Concept Results The researchers confirmed the exploit by successfully reading private conversation data and sending it to an external server. The attack was stable, often executing within 4.5 seconds of opening the link. This proved that the vulnerability was not limited to UI manipulation but extended to full account compromise through authenticated API calls. ## Security Boundary Failure The root cause was not the Preview sandbox itself, which functioned as intended. Instead, the failure occurred because a trusted component in the main page accepted instructions from an untrusted source. By combining multiple legitimate features, the researchers created a path that bypassed the security boundary, highlighting the risks of complex feature integration. ## Resolution and Patching OpenAI classified the report as P1 and implemented a fix across two versions of the web frontend. The patch, rolled out by October 26, specifically blocked the cross-frame MathLive messages. This effectively severed the communication path between the restricted Preview and the main page, closing the vulnerability for all users. ## Technical Payload Complexity The final exploit payload was highly optimized, involving over 7,000 characters for the iframe markup. The researchers used toString() conversions and whitespace collapsing to fit the payload into the callback parameter. This level of technical precision allowed the malicious code to bypass filters and execute reliably within the restricted browser environment. ## Lessons in Feature Integration This incident underscores the danger of combining isolated features without strict cross-origin validation. Every individual component appeared secure, but their interaction created a critical security flaw. Developers must ensure that message listeners and API endpoints verify the origin of all incoming data, even when those features seem benign or unrelated to authentication. ## Sources covering this story - https://www.parameter.ai/labs/we-found-a-gap-at-openai — --- _Summary written by Brifing from the original reporting. Copyright in the original article belongs to its publisher; read the full piece at the link above._