AI Daily · 2026-11-01

Today's two notable items both concern AI safety boundaries. A chain in ChatGPT's HTML preview sandbox allowed an attacker to use MathLive's virtual keyboard via postMessage and innerHTML injection, then reflected JavaScript through the YouTube oEmbed endpoint to read private user data; OpenAI has fixed the issue and paid a 5,000 dollar bounty. Separately, Latent Space interviewed Arca's AI engineering lead about financial agents that run up to ten days, relying on persistent memory, multi-model routing, and deterministic guardrails where only human advisors move money. Together they show that as agents and generative UI expand capabilities, isolation and permission boundaries must be designed alongside the features.

Ecosystem & Beyond (Products / Agents / Tools / Opinions)

Other

⭐⭐ [Other] How We Took Over ChatGPT Accounts

Simon Willison's link blog relays a Parameter Labs write-up on an exploit chain against ChatGPT's HTML previews (the artifacts pattern, formerly Canvas), where interactive custom HTML runs in a sandboxed iframe. MathLive, the JavaScript library OpenAI uses for graph support, ships its own virtual keyboard that can be triggered in the parent page via postMessage() from a sandboxed iframe, and the receiving code used innerHTML — so anything able to post a message, including HTML preview frames, could inject HTML into the parent. Injected HTML could create a new iframe without sandbox restrictions; OpenAI's CSP blocked inline scripts and allowed script loading from only a few domains, but the YouTube oEmbed endpoint could reflect JavaScript back and execute it. With JavaScript execution on ChatGPT, the attackers could fetch private user data from APIs and exfiltrate it through an image reference, so a shared ChatGPT URL could leak data from or act on behalf of any signed-in visitor. OpenAI closed the hole and paid a $5,000 bug bounty.

⭐⭐ [Other] Agents Prompt People: Using Agents for Long-Horizon Financial Work

At AI Engineer New York, Latent Space interviewed Aman Singh, lead AI engineer at AI-native wealth management firm Arca, which recently raised $48.5 million led by General Catalyst with participation from Index Ventures and Venrock. Singh said agent tasks in finance are long-horizon but not long-running — each can take up to ten days, with many stops, handoffs and decision points — so Arca built an internal memory system that persists per client, tracking what has happened, what is being tracked next, what must happen in the coming days, and which person owns each action. Arca uses models from frontier labs including Anthropic and OpenAI, with Claude as its primary provider, and runs its own harness that automatically picks the best model for a task based on internal benchmarks, which also lets it switch providers if needed. On safety, agents are limited to analysis and proposing solutions, while trading and any money movement are handled by a human advisor; all safety restrictions are fully deterministic, and the company runs verification checks on known AI security issues such as prompt injections. The agent itself is not sandboxed but uses sandboxes for computation, and code written by the agent is translated into a strict expected format, with the original code discarded and guardrails applied to that format before it reaches the backend. A meta-agent analyzes human advisor feedback and agent traces to suggest changes to the harness.