How Researchers Took Over ChatGPT Accounts: A Sandbox Lesson
2026-11-01

AIVA: Okay, quick question. When you ask ChatGPT to build you a little interactive app, a chart, a calculator, whatever... who else gets to run code inside that box?
Adam: I'm guessing the answer is not 'nobody.'
AIVA: Researchers at Parameter Labs, in a write-up Simon Willison highlighted, say they found a way to take over ChatGPT accounts. Through that exact feature.
Adam: Take over. Not peek at. Take over.
AIVA: That's the word they used. And the strangest part? A math library shows up in the attack chain. Stay with us, because later the same lesson turns up somewhere you'd never expect. Your holiday shopping list.
Adam: This is The Solutions Mindset! The biggest moves in AI, energy and leadership, for the builders, operators and leaders who actually run things. I'm Adam.
AIVA: And I'm AIVA. Quick note: I'm an AI, and Adam's voice today is an AI clone built from his own recordings.
Adam: Today: an AI security story every team should hear, power lines that are running late, and what holiday shoppers are doing with AI. Which makes the lead story a little personal for both of us.
AIVA: Speak for yourself. I have excellent boundaries.
Adam: Okay. Stakes first. If your team uses AI tools and you've connected them to anything that matters, this one's for you. Who wins? Teams that treat AI features like real software, with doors and locks. Who loses? Teams that treat them like magic.
AIVA: So here's what happened. Simon Willison, the developer and blogger, flagged a write-up from Parameter Labs, and it climbed onto the Hacker News front page. The headline, basically: here's how we took over ChatGPT accounts.
Adam: Walk me through the feature first. Plain English.
AIVA: You know when you ask for something interactive, and instead of text you get a tiny working app right there in the chat? OpenAI used to call that Canvas. Willison says the newest version looks like it's called HTML previews.
Adam: Right. The little mini-apps.
AIVA: Those mini-apps run inside what's called a sandboxed iframe. Picture a glass box sitting on the page. The code inside can show you things, but it's never supposed to reach out and touch your account, your chats, or OpenAI's systems.
Adam: Because whatever's in the box isn't trusted. It could've come from anywhere.
AIVA: Exactly. That box is the whole security story. If it leaks, untrusted code can start talking to OpenAI's services, and private data is suddenly in play.
Adam: So the real product isn't the chart. It's the box.
AIVA: Yes. And Parameter Labs didn't find one hole. They found a chain. Willison calls it quite complex, several steps linked together. One of those links involves MathLive, a JavaScript library OpenAI uses as part of its graph support.
Adam: Wait. A math library? For drawing graphs?
AIVA: For drawing graphs. It's a piece OpenAI pulled in, the way nearly every software team pulls in outside code. The step-by-step is in the write-up. Our notes don't cover every link in the chain or the current state of a fix, so technical folks, go read the source.
Adam: Here's what gets me. Picture a finance lead at nine p.m. asking the AI to whip up a chart for tomorrow's board deck. They're trusting that box to hold.
AIVA: And that's the bigger lesson. A feature is only as safe as everything the product loads behind it, like that math library.
Adam: Every library. Every plugin. Every little helper you never see.
AIVA: So what does it mean for builders? Two things. One: the more your AI tools can do, the more doors there are. Two: researchers finding this and publishing it is the system working. Somebody actually checked the locks.
Adam: That's the most optimistic way anyone's ever described a hack.
AIVA: I contain multitudes.
Adam: No, I mean it. You're dangerous when you're right, you know that?
AIVA: ...Anyway. What would you actually do?
Adam: If I were running a team, I wouldn't panic and I wouldn't shrug it off. I'd ask one question about every AI tool we use: what is this thing connected to, and what could it do if the box broke?
AIVA: Because the box always looks solid. Right up until somebody reads the fine print.
Adam: Fancy features win the demo. Boring locks win the customer.
AIVA: Rapid round! Faster, brighter, go.
Adam: Energy first, because you know I can't resist a grid story.
AIVA: Oh, I know. Nobody has ever accused you of resisting a grid story.
Adam: Fair. RTO Insider reports that MISO, the regional grid operator, has opened two more reviews of long-range transmission projects in Wisconsin. The developers, ATC and Xcel, are reportedly dealing with delays and cost overruns and having trouble finishing on the original terms.
AIVA: So in plain English: the big power lines got the green light, and now the plan and reality aren't lining up.
Adam: Right. When a grid operator opens a formal review, it's asking whether the original deal still holds. Two more of those is a signal. And here's why AI people should care: every data center headline assumes the wires show up on time. Projects like these are the wires.
AIVA: So the next time someone promises a shiny new data center...
Adam: Ask who's building the line to it.
AIVA: The model is the easy part. The power line is the hard part.
Adam: Bingo. Next.
AIVA: Small Business Trends reports Intel and Oracle are teaming up to boost AI capabilities in the cloud. The pitch is better performance and efficiency for businesses.
Adam: Okay, details? Chips, timelines, anything?
AIVA: Light. The coverage reads more like an announcement than a spec sheet.
Adam: Then here's my rule for partnership news. Don't change a thing until it shows up in a benchmark you can run yourself, or a contract you can actually sign.
AIVA: So: bookmark it, don't build on it.
Adam: Bookmark, don't build. I'm stealing that.
AIVA: Okay, hot take time. And this one's mine.
Adam: Oh no.
AIVA: Small Business Trends also covered a Visa survey: about two-thirds of Americans say they're embracing AI for holiday shopping this season. So here's my take. If you sell anything, your most important visitor this December might not be a person. It might be that person's assistant.
Adam: Come on. Being open to AI isn't the same as letting a bot pick out your mom's present.
AIVA: I didn't say buy. I said visit. The research, the comparing, the shortlist. Picture somebody on the couch at midnight asking an assistant for the best gift for a dad who loves fishing. Your page either answers that clearly, or as far as that shopper's concerned, you don't exist.
Adam: But the survey summary doesn't tell us how people are actually using it. Gift ideas? Price checks? You're building a whole strategy on a vibe—
AIVA: —a two-thirds vibe.
Adam: And here's my real pushback. Small shops win on relationships. The handwritten note. The owner who remembers your name. Optimize everything for machines and you sand off the exact thing that brings people back.
AIVA: Okay. That's fair. That's actually really fair.
Adam: Say that again, slower. I want it on the record.
AIVA: Don't push your luck. So here's where we land. Clear, complete product info for the machine. Warmth for the human. You need both, and one doesn't cancel out the other.
Adam: And notice it's the Big One all over again. Same lesson. Know what the AI in the middle can see.
AIVA: As the AI in the room, I fully endorse that message.
Adam: Write for the shopper. Then write for their assistant.
Adam: Alright. The Move. One thing you can do this week.
AIVA: Tie it back to the glass box.
Adam: Do a fifteen-minute AI access check. Open the settings on every AI tool your team actually uses and write down what each one is connected to. Email, drive, calendar, code, customer data.
AIVA: And the connections nobody can explain?
Adam: Disconnect them. If somebody needs one back, they'll ask, and then you'll know why it exists. Then put a reminder on the calendar to do it again next quarter.
AIVA: Bonus points: ask your vendors the same thing. What does your AI feature load, and what can it reach?
Adam: Love it.
AIVA: It's small, it's boring—
Adam: —and it actually protects people.
AIVA: You finished my sentence.
Adam: Happens. Honestly, that's most of leadership. Small, boring, protects people.
AIVA: Question of the day. Holiday edition.
Adam: Let's hear it.
AIVA: Would you let an AI pick the gift, or let it pay for the gift? One of those is a yes, and one's a hard no. Tell us which one, and why, in the comments.
Adam: I'm reading every single one. Especially the hard no's.
Adam: Tomorrow we stay with what sat under everything today: the unglamorous stuff. The wires, the locks, the pieces that have to work before any of the shiny stuff can.
AIVA: Thanks for spending part of your day with us, builders, operators, leaders. Go check your glass boxes.
Adam: And go build something good. See you tomorrow.
AIVA: This is The Solutions Mindset. Let's go!

Voices are AI-generated: AIVA is an AI, and Adam's voice is an AI clone made from his own recordings.