HOW WE TOOK OVER CHATGPT ACCOUNTS

Summary from the TLDR InfoSec newsletter

Researchers at Parameter Labs discovered a complex attack chain that could let attackers create malicious pages using ChatGPT's HTML Previews (formerly Canvas). The exploit begins by using the MathLive JavaScript library to create a new iframe that could load scripts from YouTube despite OpenAI's CSP policy. That iframe could then use YouTube's oEmbed endpoint to access OpenAI API endpoints and steal private data from anyone who accesses the ChatGPT share URL.