Do the math: How we took over ChatGPT accounts

> OpenAI confirmed both frontends rejected the reported messages, resolved the issue, and awarded a total bounty of $5,000.

It requires the user to click a link. But I still find this bounty very low. Others may not report them if such a small bounty is given.

Oof. Together with the fact that it's possible to remotely access the file system (!) of computers ever having started a "Work" chat in the ChatGPT desktop app [1], this seems pretty bad.

[1] https://news.ycombinator.com/item?id=50078284

Something about the writing style here makes it hard for me to follow what actually happened. The section about JSONP for example seems to be explaining how JSONP works and how it's designed as an attempt to work around these attacks, but that explanation is then passed off as an explanation of how they bypassed the protection. And the whole premise seems to be about how manipulating the Preview content let them work through multiple defensive layers, but I don't see an explanation of how they directly controlled that content in the first place. I would have thought that the only control you have over the content of "an ordinary public ChatGPT share" is the prompt text, and that any migration of that text into "a small working webpage using its Preview feature" is up to the model deciding to generate that "HTML block" in response.

Does no one write their own blogs anymore?

$5000 is a joke. They pay millions to their top devs and still have more holes than a colander so a nice guy shows you a huge opening in your platform and all you can give him is a pat on the shoulder? Did you fire your top devs and hire that guy for a million bucks plus options? Did you sue the security firm you paid millions to audit the issues?

I really hope they get hacked and crash down burning in flames like the Hindenburg

Now what about those millions of lines of code? Wasn’t the agent swarm supposed to take care of it? All jokes aside this is exactly what happens as you build larger monoliths, system complexity and bug surface increases logarithmically… so in all seriousness you want to reduce LOC as much as possible. Maybe this can teach OpenAI a lesson to produce software that’s correct and adhere to established engineering standards over sensationalised “we built so much code” promotional material.

Appreciate the incremental write up building up the scope of the poc.

I like the chain of regular old school things used to achieve it like post message, JSONP, iframe, Img tags.

$5000 is a joke for a "P1" vuln

5k makes me think the next guy is gonna sell his exploit in the black market instead.

we are getting to the point of “why have passwords?” Right? At some point soon we have to move to the honor system of just please don’t login as me?

if only they had some sort of cybersecurity state of the art thing...

I think there was another HN discussion about it re bounty value and as far as I remember the issue is not that big companies are greedy in that case, but rather that over time it’s strategically better to have lower bounties so less people are interested in it.

5 or 50k doesnt matter to them. And this bug in terms of severity is very high imho.

only $5000 for this, lmao. It should be $50k out of pure shame. If they don't make these things hurt just a little they're never going to take following best practices seriously enough. There will be 9 more anyways.

Meanwhile the actual user of the account probably has to sign in using a yubikey because they get "CyBeRsEcRuItY aLeRtS" when they try to update node in their project to fix a crash and have to switch to daybreak blue to continue (or attempt to trick the normal models into doing it and risk getting autobanned)

unrelated to this, but this company randomly reached out disclosing a vulnerability to us (test environment, synthetic tenant). on the one hand, thank you, it’s patched. on the other - we do not have a bug bounty program and this is not welcome. having agent swarms randomly breaking in to environments and then marketing their services in the disclosure is not an ideal sales tactic, in addition to being illegal.

> able to take over anyone's account simply by sending them a link

dont click links people

that'll be $500k for the security training pls

It's exhilarating (for the lack of the knowledge of a better word) to see OpenAI and Anthropic starting getting hacked and getting a taste of their own medicine. Brings back hope that actual software engineering is not dead yet.

Hex aka Parameter is an irresponsible company, on my blacklist. after they did an unsolicited pentest on us, we scheduled a call. joke of a team.

hilarious that their headline message, on every web page, is `Backed by YC`.

also, the product is way behind their competitors anyway.

really cool exploit they found here, but that doesn't make them a company worth doing business with.

5k is nothing for the amount of headache you just saved them..

Claude or Gemini didn’t find the vulnerability on ChatGPT?

Sigh. With how good Openai are good in programming frontier agents, they still have weak security. Hmmn, i'm short of words.

why didnt the black box of bullshit company detect this? for a group that touts every inane 'discovery' with hyperbolic bullshit, they really fall short on delivering anything of actual value, just rehashed bullshit.

[flagged]

[flagged]

[flagged]

[flagged]

Another classic OAuth implementation failure. Mismanaging the state parameter or leaking tokens via referer headers in redirects is Security 101. Wild to see this in a production environment of this scale.