Do the math: How we took over ChatGPT accounts
Researchers describe how they were able to hijack ChatGPT accounts via a crafted link that abused web preview behavior and old-school browser primitives like `postMessage`, iframes, and JSONP. Commenters criticize OpenAI’s security posture and especially the $5,000 bug bounty for an account-takeover-class vulnerability, arguing it undervalues responsible disclosure and may push future finds to the gray market. The thread broadens into concerns about growing software complexity, questionable OAuth and client-side implementations, and the irony that leading AI companies still rely on fragile, error-prone web stacks they claim their own agents could secure.
Vulnerability severity and attack mechanics
- Commenters see this as a serious account‑takeover issue, especially combined with other capabilities like remote filesystem access via “Work” sessions in the desktop app.
- Some are surprised such basic web security failings (e.g., unchecked
postMessage, JSONP misuse, OAuth/state mistakes, referer leaks) appear at this scale. - Others appreciate the write‑up’s step‑by‑step chaining of classic web tricks (iframes, postMessage, JSONP, image tags), though a few find the explanation confusing or incomplete.
Bug bounty amount and incentives
- The $5,000 bounty for a P1 account‑takeover vuln is widely viewed as insultingly low given OpenAI’s valuation and the potential impact.
- Several argue low bounties discourage responsible disclosure and may push future researchers toward selling exploits privately or on gray markets.
- Others note some large firms are even worse (e.g., fixing vulns without paying), and that companies may intentionally keep bounties low to limit inbound reports.
- There is debate over whether bounty size should reflect severity vs. researcher effort, and whether “fixing it at all” is itself a big value.
Ethics: disclose vs. exploit
- One side insists on reporting to vendors out of ethical duty, regardless of payout or company wealth.
- Another side argues that extremely powerful, profit‑driven companies that themselves behave questionably deserve no special moral consideration.
- There’s discussion around the legality of selling exploits and whether it constitutes criminal facilitation; consensus is that it’s risky and fact‑dependent.
LLMs, security testing, and software quality
- Some ask why OpenAI’s own “agent swarms” or other LLMs didn’t find this bug; others doubt current AI can autonomously uncover such nuanced issues.
- Several criticize OpenAI’s broader engineering culture (huge codebases, marketing hype) and call for simpler, more secure designs and reduced attack surface.
- There’s a related debate on whether lines of code are a meaningful proxy for complexity and vulnerability surface.
Email links, phishing, and “don’t click links”
- The exploit requires a clicked link, prompting jokes about security training that boils down to “don’t click links.”
- Commenters note that link‑scanning email “security” products can auto‑visit links, complicating such advice and occasionally breaking GET‑based confirmation flows.
Meta: blog quality and AI‑generated content
- Multiple people complain that the blog post reads like LLM‑generated marketing, written more for bots than humans.
- Others emphasize still writing their own blogs by hand to improve understanding and preserve human‑level clarity.