No. 1Score 0.80
We Took over ChatGPT Accounts
Summary and score for “We Took over ChatGPT Accounts”
Parameter Labs reported a chain in ChatGPT's web app that turned a public shared conversation into JavaScript running as chatgpt.com in the viewer's session. A sandboxed HTML Preview sent postMessage commands to MathLive, loaded for graphs, which accepted any sender and inserted HTML into the main page. An unsandboxed iframe and YouTube's oEmbed JSONP endpoint, allowed by the CSP, completed execution. The researchers read a private conversation and sent a small piece off-site. OpenAI fixed it October 26 and rated it P1; the claims rest on Parameter's own account.
Score 0.80Claim check: 8 no source given
Elsewhere: HN 315 pts, front page
Score breakdown and claims for “We Took over ChatGPT Accounts” · Also covered by Simon Willison