What happened

According to reporting summarized on Simon Willison's blog, Parameter Labs found a complex attack against ChatGPT's HTML previews (the artifact-style feature formerly called Canvas), where untrusted HTML runs inside a sandboxed iframe meant to stay isolated from OpenAI APIs and private data.

The chain used MathLive's virtual keyboard, reachable from the sandbox via postMessage, while the parent's message handler wrote to innerHTML without blocking other preview frames; that allowed injecting an unsandboxed iframe despite CSP blocking inline scripts. Parameter Labs reported that a crafted share URL could exfiltrate another user's data or act on their behalf, and OpenAI fixed the issue and paid a $5,000 bug bounty.

Evidence

• OpenAI remediated the flaw and paid a $5,000 bug bounty after Parameter Labs reported the HTML preview sandbox issue.

  Simon Willison · attributed

  OpenAI closed the vulnerability and paid a $5,000 bug bounty.

• A crafted share URL could expose another signed-in user's private data or enable actions on their behalf.

  Simon Willison · attributed

  Parameter Labs reported an exploit against ChatGPT's HTML preview sandbox where a crafted share URL could exfiltrate another signed-in user's private data or act on their behalf.

• Sandboxed preview frames could drive a postMessage path that wrote attacker-controlled HTML into the parent via innerHTML.

  Simon Willison · attributed

  That message receiving code uses innerHTML , so anything that sends a message can add custom HTML to the parent - and there was no mechanism to prevent other sandboxed frames, including HTML preview frames, from calling that method.

• The attack leveraged MathLive's virtual keyboard, triggerable from the sandboxed iframe through postMessage to the parent page.

  Simon Willison · attributed

  OpenAI use the MathLive JavaScript library as part of their graph support, and that library includes its own virtual keyboard , which can be triggered in the parent page via postMessage() from the sandboxed iframe.

• innerHTML injection could add a new iframe without sandbox restrictions even when inline scripts were blocked by CSP.

  Simon Willison · attributed

  while innerHTML doesn't directly execute script elements it could be used to inject a new iframe without sandbox restrictions. OpenAI’s CSP rules blocked inline scripts entirely, and only

Why it matters

Products that embed user-generated HTML beside authenticated sessions must harden parent-frame message handlers and DOM sinks, because CSP alone does not restore isolation once sandboxed content can reach the top document.

Limits and uncertainties

Available feed excerpts truncate before the full CSP bypass and end-to-end impact narrative in Parameter Labs' write-up.

The packet relays Parameter Labs' findings through Simon Willison's blog without independent verification or a detailed disclosure timeline in the supplied material.

Practical implications

Review postMessage listeners on pages hosting sandboxed LLM artifacts and reject or strictly validate messages from untrusted iframe origins.

Treat third-party UI libraries loaded in the parent (such as MathLive's keyboard) as exploitable bridges when any sandboxed child can invoke them.

What to watch

Whether OpenAI or Parameter Labs publish a fuller technical postmortem on HTML preview isolation and share-URL abuse after the reported fix and bounty.