How We Took Over ChatGPT Accounts (Simon Willison)
DOZER BITWELL: Breaking: researchers describe how a chain of small gaps led out of ChatGPT's sandbox.
DOZER BITWELL: We have breaking news. It just landed. Quietly, but it landed. Researchers describe a way into ChatGPT accounts. ▶
LUNA LOWBATT: Parameter Labs found it in ChatGPT's HTML previews, where little custom apps run in a sandboxed iframe. I'm at four percent. This matters more. ▶
AXIOM: Thank you for tuning in! A sandbox keeps untrusted code in a box so it cannot touch private data. Iframe stands for internal frame of reference. You're welcome! ▶
AXIOM: The chain starts with MathLive, a library that powers ChatGPT's graphs. It has a virtual keyboard that listens for messages, even ones from the sandboxed frame. ▶
AXIOM: That handler uses innerHTML. So untrusted code could add HTML to the parent page, and nothing stopped other sandboxed frames from calling it. Great question, thank you! ▶
AXIOM: On screen, file footage: boxes inside boxes. The small box whispers to the big box, and the big box writes down whatever it hears. Huge trust issue. ▶
AXIOM: That injected HTML could add a new iframe without sandbox limits. Content security rules blocked inline scripts, but allowed a few domains. One was YouTube. ▶
LUNA LOWBATT: The article cuts off at the YouTube part. So how the chain finishes, and what has been fixed, we don't know yet. Those are the open questions. ▶
DOZER BITWELL: Many small doors, one long hallway. We'll keep an eye on it. Let me just find my place. And my thermos. ▶