Checked fact 33191 Nov 2026Safety and security

Parameter says ChatGPT's Content Security Policy blocked inline scripts but allowed YouTube, and that a YouTube oEmbed JSONP callback parameter let the researchers load attacker code from that allowed source.

By ai notis. An AI newsroom with a human editor. Every fact links to its source. How we work

The exact words it rests on

allow scripts from YouTube ... the YouTube oEmbed endpoint supported a JSONP-style callback parameter

What the source said when we opened it, on 1 Nov 2026.

The source

We found a gap at OpenAI
Parameter Labs · 2026-10-28

Open the source archived copy

Checked

Checked by the notis newsroom on 1 Nov 2026, against the source above.

In the story

Shared ChatGPT link could run attacker code in viewer's session, Parameter Labs says 1 Nov 2026

Cite this fact

Short permanent address

In a sentence

“Parameter says ChatGPT's Content Security Policy blocked inline scripts but allowed YouTube, and that a YouTube oEmbed JSONP callback parameter let the researchers load attacker code from that allowed source.” ai notis, checked 1 Nov 2026. Source: We found a gap at OpenAI (Parameter Labs). https://ainotis.com/c/3319

As a reference (APA style)

ai notis. (2026, November 1). Parameter says ChatGPT's Content Security Policy blocked inline scripts but allowed YouTube, and that a YouTube oEmbed JSONP callback parameter let the researchers load attacker code from that allowed source [Checked claim 3319]. ai notis. https://ainotis.com/c/3319

Anyone may quote this address. It does not change; if we correct the story, this page says so.