How We Took Over ChatGPT Accounts

Parameter Labs has published a writeup titled “How We Took Over ChatGPT Accounts,” describing an exploit the firm found against ChatGPT’s implementation of the artifacts pattern. According to the report, flagged by commentator Simon Willison on October 31, 2026, the vulnerability concerns the feature OpenAI once called “Canvas,” which in its latest revision appears to be named “HTML previews.” The feature allows interactive custom HTML applications to be displayed within ChatGPT conversations.

The available excerpt indicates that Parameter Labs identified a gap in how these interactive HTML apps are rendered and handled inside the platform, though the full technical mechanics of the exploit are not detailed in the material at hand. Willison’s commentary links directly to the Parameter Labs writeup and to OpenAI’s own help documentation describing how users work with what the company now terms “writing blocks and code blocks” in ChatGPT, suggesting a connection between the naming change and the feature under scrutiny.

The excerpt does not specify when OpenAI introduced the renamed feature, nor does it confirm the exploit’s current status, whether it has been patched, or how many accounts may have been affected. Further detail on the account takeover mechanism itself is not present in the material provided. Observers awaiting fuller technical disclosure will need to consult the original writeup directly, as the available summary covers only the feature’s naming history and the general nature of the reported gap.