Do the math: How we took over ChatGPT accounts
By bypassing ChatGPT's sandbox and content security policy, our research team was able to take over anyone's account simply by sending them a link.
Quick read
A security-research writeup showing how a combination of ChatGPT’s HTML Preview and a graph using MathLive allowed JavaScript to run inside a signed-in ChatGPT session, enabling account takeover via a shared conversation link. Someone would read this to understand the specific vulnerability chain OpenAI fixed and the exact technical steps that allowed exploitation.
- Preview feature can send postMessage into main page
- MathLive listener accepted unvalidated messages with HTML
- Srcdoc iframe plus YouTube JSONP bypassed CSP to execute scripts
Reactions
No reactions yet. Record a short about this link and it shows up here, in Reels and in the community feed.
Is parameter.ai your site? Sign in to verify it and get a Verified badge, full stats and a link-back badge.
What we found on this site
- Built with
- Next.js
- Served through
- Vercel
- Home page answered in
- 139 ms
- Trackers
- Google Tag Manager
- Ads
- None found
- RSS feed
- Yes
- AI crawlers
- Lets them in
- llms.txt
- Yes
- Set up for phones
- Yes
- Real-visitor speed
- Passes Core Web Vitals
- Popularity
- Top 200,000 domain (Cloudflare)
- Google safety check
- No threats found
- Domain registered
- 2017
- Domain renews
- June 2027
Checked November 1, 2026 from the site’s own code and public records. See how the rest of the web compares in the NexURLs Internet Report.
Sites like Do the math
- ChatGPTchatgpt.com
- LibreChatlibrechat.ai
- Janjan.ai
- ChatGPT and Fake New Yorker Cartoonsniemanlab.org
This page discusses how ChatGPT is generating fake New Yorker cartoons with real cartoonists' signatures. It...
- Poepoe.com
- HelpHub - GPT chatbot for any sitehelphub.commandbar.com
More Tech & AI finds
- bolt.diygithub.com
- Dyaddyad.sh
- OpenManusgithub.com
- Open WebUIopenwebui.com
- The cryptography behind electronic voting (and why paper ballots are stillblog.trailofbits.com
- Man-in-the-middle arbitrary code execution in Debian’s aptlists.debian.org
Feeling lucky? Try the random website generator.
Where people went next
Nobody has added a next stop yet. Be the first.