One shared ChatGPT link could take over your account, thanks to a math keyboard

Sandboxes are only as strong as the friendliest component that sits next to them. This time it was a math keyboard.

Parameter Labs found a way to break out of ChatGPT's HTML previews, the sandboxed iframes where generated mini-apps run, as Simon Willison summarized on his blog.

The chain

• ChatGPT uses the MathLive library for graphs. MathLive ships a virtual keyboard that a sandboxed frame can trigger in the parent page with postMessage.
• The code receiving that message wrote it with innerHTML, and nothing stopped other sandboxed frames, including HTML previews, from sending it.
• innerHTML won't run script tags, but it will happily insert a new iframe with no sandbox at all.
• OpenAI's Content Security Policy blocked inline scripts and allowed only a few script hosts. One was YouTube, whose oEmbed endpoint could be abused to reflect JavaScript that then executed.
• With script running on ChatGPT itself, pulling private data from the APIs and leaking it through an image URL was easy.

The result: a ChatGPT share link that, opened by a signed-in user, could steal their data or act as them. OpenAI fixed it and paid a $5,000 bounty, which Willison thinks was low for a bug this serious. We agree.

For developers

If you render model-generated HTML, the iframe sandbox isn't the whole story. Every postMessage listener on the parent page is part of your attack surface, and so is every third-party library that installs one. Validate the message origin, never pipe message data into innerHTML, and audit your CSP allowlist for endpoints that can echo attacker input.

Scoreboard update: Humans +1. Security researchers break ChatGPT's sandbox before attackers do.

Stay undead.