Source

Parameter Labs

1 item

The research blog of Parameter, where its team publishes vulnerabilities it found in AI products, with the exploit chain and the disclosure timeline. Primary for the research itself; what the vendor fixed and paid is cited as the researchers' account.

parameter.ai ↗

An abstract illustration from the MathLive project: translucent blue and orange columns of different heights rising in steps against a dark blue background.

Web

Researchers show a shared ChatGPT link could take over the account of whoever opened it

Parameter Labs chained a math library's message listener, an unsandboxed frame, and a YouTube endpoint to run code as chatgpt.com in a signed-in victim's session. According to the researchers, OpenAI fixed the flaw on October 26, 2026. MathLive, the library at the center of the chain, tightened its defaults on October 31. Sites that connect its virtual keyboard to a page on another origin now have to name the origins they trust.

Parameter LabsNovember 1verified