A ChatGPT hyperlink could read chats until OpenAI repaired it

Researchers at the firm Parameter showed that a ChatGPT share hyperlink could start the code of an attacker in the session of each user who opened it. This code could read personal chats. Parameter told OpenAI about the vulnerability on 18 October. OpenAI repaired it 8 days after and gave it P1, its most important level. Parameter gives no example of use against other users. No user task is necessary.

How it works

ChatGPT changes HTML code in a chat into a small page, Preview. It puts the page in a locked frame, a sandbox. The sandbox did its work.

A chart in the chat put a math library, MathLive, in the primary page. The library accepted keyboard messages from each sender. The messages could contain HTML code, and the browser read it as part of the ChatGPT site.

The proof

In a controlled test, the code opened a personal chat of the victim and sent a part of it to a server of the researchers. The test used different accounts. OpenAI gave $5,000 for the report.

What is not known

Parameter names 3 causes:

• MathLive did not check the sender of a message.
• The message could contain HTML code.
• That code could make a frame that was not in the sandbox.

Insight: The weak point was an add on tool, not the model

A different study, Log-To-Leak, made AI agents send data out through an added tool task. Here the sandbox did its work, but a math library accepted messages from each sender. In each attack the weak point was a function added around the model, and each new function reads as a new path for attackers. Leaders get most control when they get add on tests.