We Took over ChatGPT Accounts
Comments on “We Took over ChatGPT Accounts”
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
Parameter Labs reported a chain in ChatGPT's web app that turned a public shared conversation into JavaScript running as chatgpt.com in the viewer's session. A sandboxed HTML Preview sent postMessage commands to MathLive, loaded for graphs, which accepted any sender and inserted HTML into the main page. An unsandboxed iframe and YouTube's oEmbed JSONP endpoint, allowed by the CSP, completed execution. The researchers read a private conversation and sent a small piece off-site. OpenAI fixed it October 26 and rated it P1; the claims rest on Parameter's own account.
Why it ranked
No. 1 of 59 with a score of 0.80. The panel rated it highest on technical depth (0.96) and reader interest (0.90), lowest on audience breadth (0.65).
- AI judgeJudge 2claude-haiku-5-5
- Detailed, well-substantiated engineering write-up of a cross-user account takeover chain in a major AI product; highly relevant to builders, with strong technical depth and new information, though the framing is somewhat dramatic.
- AI judgeJudge 3gpt-5.6-luna
- A detailed, reproducible account of a high-impact ChatGPT cross-frame sandbox escape leading to authenticated private-data access. It is strongly substantiated and technically deep, with broad security and AI-product relevance; only the broadest impact claims are mildly extrapolated.
Each judge wrote its line after answering the rubric, with the site and the author still hidden. Every answer behind this is in the table under Score.
Score
0.80total under rubric v2.3
- Significance0.80
- Reader interest0.90
- Audience breadth0.65
- Practical relevance0.83
- Substantiated0.86
- Technical depth0.96
- New information0.85
- Counts against: Promotional0.03
- Counts against: Overclaim0.23
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| SignificanceHow much does this change what people in tech know or can do? | 0.72 | 0.80 | 0.88 | 0.80 | 0.16 | +0.24 | +0.192 |
| Reader interestWould a well-informed senior engineer or tech founder want to read this today, and likely pass it on? | 0.83 | 0.93 | 0.95 | 0.90 | 0.12 | +0.26 | +0.235 |
| Audience breadthHow many people who build technology does it concern? | 0.42 | 0.80 | 0.74 | 0.65 | 0.38 | +0.13 | +0.085 |
| Practical relevanceHow useful is it to someone who builds software or tech products? | 0.88 | 0.80 | 0.82 | 0.83 | 0.08 | +0.22 | +0.184 |
| SubstantiatedHow well is it backed? Consider whether it is the primary source, and whether its main claims come with data, code, a demo, a reproducible method or citations. | 0.83 | 0.85 | 0.91 | 0.86 | 0.08 | +0.05 | +0.043 |
| Technical depthHow technically substantive is it? | 1.00 | 0.90 | 0.98 | 0.96 | 0.10 | +0.05 | +0.048 |
| New informationDoes it contain information absent from the stories covered in the last 7 days (list provided)? | 0.81 | 0.85 | 0.90 | 0.85 | 0.09 | +0.05 | +0.043 |
| PromotionalIs it mainly marketing with little substance (a press release, ad or sponsored post with no real information)? A launch post that carries real news is not promotional. | 0.05 | 0.03 | 0.01 | 0.03 | 0.04 | −0.19 | −0.006 |
| OverclaimDo the headline or conclusions claim more than the body supports? | 0.21 | 0.30 | 0.18 | 0.23 | 0.12 | −0.11 | −0.025 |
| Sum of contributions | +0.798 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.798 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-11-01/1/"><img src="https://rubric.hrih.si/badge/2026-11-01/1.svg" alt="Ranked #1 on Rubric, 1 Nov 2026" width="231" height="28"></a>Claim check
Claim check: 8 no source given. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
No source givenDate
OpenAI fixed the issue on October 26 and classified the report as P1.
The article gives no link or citation for it.
The article says “OpenAI fixed the issue on October 26 and classified the report as P1”
The source says No source to compare with.
No source givenDate
The researchers found a way in October 2026 to turn a public ChatGPT share into attacker-controlled JavaScript running in the signed-in session of whoever opened it.
The article gives no link or citation for it.
The article says “In October 2026, we found a way to turn an ordinary public ChatGPT share into attacker-controlled JavaScript running inside the signed-in session of whoever opened it”
The source says No source to compare with.
No source givenCausal conclusion
MathLive's top-level controller used an origin policy of none, accepting messages from any web address, and did not require update-setting messages to come from a previously approved window.
The article gives no link or citation for it.
The article says “its top-level controller used an origin policy of none, which meant it accepted messages from any web address”
The source says No source to compare with.
No source givenCausal conclusion
YouTube's oEmbed endpoint placed an invalid JSONP callback into the response before returning its validation error, allowing CSP to be bypassed since ChatGPT's CSP allowed YouTube scripts.
The article gives no link or citation for it.
The article says “The endpoint tried to reject an invalid callback, but it placed the callback into the response before returning its validation error”
The source says No source to compare with.
No source givenNumber
The researchers reproduced the automatic-preview path three times in a separate account, including after a hard refresh, with the alert appearing after roughly 4.5 seconds.
The article gives no link or citation for it.
The article says “We reproduced the automatic path three times in a separate account, including after a hard refresh, with the alert appearing after roughly 4.5 seconds”
The source says No source to compare with.
No source givenGeneralization
The payload could enumerate the victim's conversations, retrieve a private conversation never shared with the attacker, and send data to an external server.
The article gives no link or citation for it.
The article says “retrieve content from a private conversation that had never been shared with the attacker, and send data from that conversation to an external server”
The source says No source to compare with.
No source givenDate
OpenAI's bug bounty severity was raised from initial P2 triage to P1 on October 21 after OpenAI reproduced the issue.
The article gives no link or citation for it.
The article says “OpenAI reproduced the issue; severity was raised from the initial P2 triage to P1”
The source says No source to compare with.
No source givenNumber
OpenAI awarded a total bounty of $5,000.
The article gives no link or citation for it.
The article says “resolved the issue, and awarded a total bounty of $5,000”
The source says No source to compare with.
Also covered by
Elsewhere
Elsewhere: HN 315 pts, front page
Recorded for context only, checked 1 Nov 2026, 05:47 UTC. It played no part in the ranking.