Do the math: How we took over ChatGPT accounts

8.6 relevance

Detailed account of ChatGPT account takeover via math-based exploit, highly actionable for security.

AI/ML parameter.ai

Answer the board on AI readiness

Arrive with evidence, not opinion. See how your foundation benchmarks against your peers, get a clear read, and leave with a ranked place to start.

Why It Matters

For platform engineers building AI/ML agent orchestration systems, this highlights how seemingly isolated features (a math library's keyboard listener and an HTML preview sandbox) can create cross-origin attack surfaces that bypass CSP and same-origin policy, directly threatening the security of any service that renders user-generated content with postMessage communication.

Key Takeaways

Audit all postMessage listeners in your stack for origin validation, especially those in third-party libraries like MathLive that accept HTML in message payloads, and enforce strict Content Security Policy directives that prevent untrusted frames from communicating with the main application origin.

Do the math: How we took over ChatGPT accounts

Summary

Parameter AI researchers exploited a cross-frame postMessage vulnerability in ChatGPT's MathLive library to bypass the sandbox and content security policy, achieving full account takeover by sending victims a shared conversation link. The attack chain combined an HTML Preview frame (restricted to a different origin) with a graph component that installed an unvalidated postMessage listener, allowing arbitrary JavaScript execution in the victim's authenticated session. OpenAI patched the issue as P1 severity on October 26, 2026, after the team demonstrated the ability to enumerate private conversations and call authenticated APIs without any victim action beyond opening the link.

Author

Mukul Goyal