A colleague sends you a link to a ChatGPT conversation: "look at the answer, it's exactly our problem". You click. Until late October, that single click could be enough to run code in your own session.

The flaw was fixed by OpenAI on October 26, with no action needed on the user side (The Hacker News). What interests me here is its cause, because it shows up in many applications, including the ones we generate with AI.

The flaw didn't come from AI, but from a forgotten line

ChatGPT renders math formulas with a library, MathLive. It talks to the page through postMessage, the mechanism that lets windows or iframes exchange messages.

The problem: the listener accepted messages without checking where they came from. Any page able to send a message could therefore make it perform actions.

An AI application is still a web application, with the flaws of every web application.

A postMessage listener must always check the origin

The rule is simple: before handling a message, check that it comes from an expected origin, then that its content has the expected format.

const ALLOWED_ORIGINS = ['https://app.example.com']; window.addEventListener('message', (event) => { // 1. Reject any message from an unknown origin if (!ALLOWED_ORIGINS.includes(event.origin)) { return; } // 2. Check the format before acting const data = event.data; if (typeof data !== 'object' || data.type !== 'formula:update') { return; } updateFormula(String(data.value)); });

In the other direction, always specify the target when sending, rather than '*':

iframe.contentWindow.postMessage(message, 'https://widget.example.com');

Generated code needs the same review

When you ask an assistant to integrate a widget or an iframe, it often produces a listener that works on the first try, and accepts everything. The code works in the demo, so we move on.

That's where review matters. A few questions are enough: who can send this message? What does the code do with its content? What happens if that content is malicious?

What AI writes quickly still has to be read through an attacker's eyes.

And you, when did you last check the message listeners in your applications?