The researchers disclosed the vulnerability via OpenAI's bug bounty program on October 18, and the company promptly addressed it eight days later, classifying it as the most critical P1 severity level This article explores disclosed vulnerability openai. . The attacker could have simply clicked the ChatGPT Preview button without the victim needing to do anything.
In a more reliable scenario, the attacker set the page to open the Preview automatically, making the victim's only step opening the link.
This allowed the code to operate with the victim's full web access, thereby expanding its reach beyond the chats themselves. The researchers noted that "we could perform any action on behalf of the victim's ChatGPT account," highlighting the extent of the vulnerability. It did not reveal any actual exploitation of the vulnerability, and the test involved a private-chat proof conducted between distinct user accounts rather than engaging with real users.
This page can contain any code, and ChatGPT runs it in a restricted environment on a separate web address, ensuring it cannot access the main ChatGPT page around it. It was discovered that this listener accepted keyboard input from any sender, allowing the message to carry raw HTML. This enabled the Preview to bypass the boundary and deliver potentially malicious HTML to a trusted main page.
