Small business owners whose teams use ChatGPT for client work should rotate active sessions and avoid opening shared ChatGPT conversation links from unknown senders, because Parameter Labs disclosed an exploit chain that could hijack a signed-in account from a single shared link. OpenAI has already patched the bug and paid a $5,000 bounty, so HTML previews are safe again - but the lesson about trust boundaries stays.
The attack is layered. ChatGPT runs user-generated apps inside sandboxed iframes called HTML previews. OpenAI's MathLive integration listened for postMessage events from any frame and piped them into innerHTML on the parent page, with no origin check. Injected markup could spawn a new iframe without sandbox flags, and OpenAI's CSP allowed scripts from YouTube - whose oEmbed endpoint reflects attacker-controlled JavaScript back. The writeup from Simon Willison walks through how the final payload exfiltrated private chat data via an image URL.
What this means for a small business
If invoices, contracts, or customer data pass through your ChatGPT browser session, treat that session like a bank login: one person per profile, no shared links from strangers, no quick previews of prompts a client emailed you. For anything sensitive I would rather run the LLM against a backend-held API key where the browser never sees the archive, so a UI-side bug cannot leak the whole corpus. The same reasoning sits under projects like a legal archive audit pipeline I built, where documents never touch a shared SaaS tab.
Why it matters: Hosted AI tools will keep shipping browser-side bugs; the practical defense is to keep sensitive processes off the shared UI surface and inside pipelines you own.
Source: Simon Willison