Security · 1 November 2026
Parameter Labs Exploit Lets Attackers Take Over ChatGPT Accounts via HTML Previews
Parameter Labs discovered an exploit in OpenAI's ChatGPT artifacts (HTML previews) where untrusted iframe code could inject HTML via innerHTML, allowing a crafted share URL to exfiltrate private data or act on behalf of signed‑in users; OpenAI patched the issue and paid a $5,000 bounty.
Why it matters
Review sandboxing of HTML preview features before launching new chat UI elements; the exploit shows shared links can compromise accounts.
For product managers
For your product
What does this mean for your product?
Try it on your product More from this issueAll AI news from 1 Nov →
Get this every morning, written for your product.
Deltaday reads the whole AI news cycle and tells you what changed, whether it's real yet, and what to do about it.