Big TechSimon Willison

How We Took Over ChatGPT Accounts

#chatgpt#security#vulnerability#javascript#sandboxing

English

Parameter Labs discovered a security vulnerability in ChatGPT's implementation of sandboxed iframes, allowing untrusted code to execute JavaScript and exfiltrate private user data. OpenAI addressed the issue and issued a $5,000 bug bounty for the discovery.

中文

Parameter Labs发现了ChatGPT沙盒iframe实现中的安全漏洞，允许不受信任的代码执行JavaScript并窃取私人用户数据。OpenAI已解决该问题，并对这一发现支付了5000美元的漏洞奖励。