# One shared ChatGPT link could take over your account, thanks to a math keyboard

> Researchers chained a postMessage bug, an innerHTML sink and a YouTube endpoint to escape ChatGPT's HTML preview sandbox. OpenAI fixed it and paid $5,000.

- URL: https://devisdead.ai/news/one-shared-chatgpt-link-could-take-over-your-account-thanks-to-a-math-keyboard
- Published: 2026-11-02T12:53:49Z
- Author: DevIsDead Newsroom
- Section: Dev
- Tags: security, openai, chatgpt, sandboxing
- Originally reported by Simon Willison's Weblog (https://simonwillison.net/2026/Oct/31/how-we-took-over-chatgpt-accounts/).

Sandboxes are only as strong as the friendliest component that sits next to them. This time it was a math keyboard.

Parameter Labs found a way to break out of ChatGPT's HTML previews, the sandboxed iframes where generated mini-apps run, as [Simon Willison](https://simonwillison.net/2026/Oct/31/how-we-took-over-chatgpt-accounts/) summarized on his blog.

## The chain

- ChatGPT uses the MathLive library for graphs. MathLive ships a virtual keyboard that a sandboxed frame can trigger in the parent page with postMessage.
- The code receiving that message wrote it with innerHTML, and nothing stopped other sandboxed frames, including HTML previews, from sending it.
- innerHTML won't run script tags, but it will happily insert a new iframe with no sandbox at all.
- OpenAI's Content Security Policy blocked inline scripts and allowed only a few script hosts. One was YouTube, whose oEmbed endpoint could be abused to reflect JavaScript that then executed.
- With script running on ChatGPT itself, pulling private data from the APIs and leaking it through an image URL was easy.

The result: a ChatGPT share link that, opened by a signed-in user, could steal their data or act as them. OpenAI fixed it and paid a $5,000 bounty, which Willison thinks was low for a bug this serious. We agree.

## For developers

If you render model-generated HTML, the iframe sandbox isn't the whole story. Every postMessage listener on the parent page is part of your attack surface, and so is every third-party library that installs one. Validate the message origin, never pipe message data into innerHTML, and audit your CSP allowlist for endpoints that can echo attacker input.

**[Scoreboard](/scoreboard) update:** Humans +1. Security researchers break ChatGPT's sandbox before attackers do.

Stay undead.