ChatGPT HTML Preview Sandbox Vulnerability Disclosed
Understand the story
On November 1, 2026, Parameter Labs disclosed a sophisticated attack chain targeting ChatGPT's HTML previews (formerly Canvas) sandbox iframe, along with a full breakdown of the attack chain. According to Simon Willison's report, the vulnerability involves ChatGPT's HTML previews sandbox iframe and is described as an account takeover vulnerability. Publicly available information currently comes mainly from Parameter Labs' breakdown report; there have been no further reports on the vulnerability's scope of impact, whether it has been fixed, or an official response from OpenAI.
AI overview of reporting · Updated 3 h前
Reporting timeline
Explore different aspects of the story through its reporting.
- Simon WillisonHow We Took Over ChatGPT Accounts
Parameter Labs has disclosed a sophisticated attack chain targeting the sandbox iframe of ChatGPT HTML previews (formerly Canvas).
Story heat trend
Current heat9·Comparable peak10（11/1 08:00）·Comparable change over 24 hours –
The trend compares the same continuously observed sources, which may cover fewer sources than the current heat score. Hover or select the chart to inspect each hour; use the left and right arrow keys to navigate.