How We Took Over ChatGPT Accounts

A flaw in ChatGPT's HTML preview/artifacts feature allowed untrusted iframe content to break out of its sandbox, gain JavaScript execution, and potentially access private data or act on behalf of signed-in users. For CIOs and technology leaders, the business risk is not just a point vulnerability but the broader exposure of customer trust, data privacy, and brand integrity when AI platforms rely on complex third-party libraries and permissive content-loading rules.