LATIDIA · Agentes
Cómo nos apoderamos de las cuentas de ChatGPT
Cómo nos apoderamos de las cuentas de ChatGPT Parameter Labs describe una vulnerabilidad que encontraron contra la implementación de ChatGPT del patrón de artefactos (OpenAI solía llamarlo "Canvas", pero parece que la última revisión se llama
WhatsApp ↗Telegram ↗
La noticia
How We Took Over ChatGPT Accounts Parameter Labs describe an exploit they found against ChatGPT's implementation of the artifacts pattern (OpenAI used to call this "Canvas" but it looks like the latest revision is called HTML previews ), where interactive custom HTML apps are displayed in a sandboxed iframe. It's important that HTML in these stays tightly sandboxed to avoid untrusted code interacting with OpenAI APIs and accessing private data. Parameter found quite a complex attack chain. OpenAI use the MathLive JavaScript library as part of their graph support, and that library includes its own virtual keyboard , which can be triggered in the parent page via postMessage() from the