The Architecture of Trust: Amblyotube's On‑Device Design After the ChatGPT Link Vulnerability

When a $5K Bug Bounty Reminds Us What 'Trust' Costs in Vision Therapy Software

The Hook

Researchers just earned $5,000 for reporting a ChatGPT share‑link vulnerability that let attackers execute code in the logged‑in session of anyone who merely opened the link. Swati Khandelwal at The Hacker News broke the story on Techmeme. No download, no install — just open the link and the attacker’s code runs in your session. It’s a stark illustration of how much implicit trust we place in shared links. In consumer AI, that trust guards your data and account. In vision‑therapy software, it guards something more intimate: your visual system, your daily training routine, the progress you’ve built over months.

Why This Moment Matters for Amblyopia Training

Amblyotube, developed by Seven Sports, takes a fundamentally different architectural approach. It ships as a stand‑alone Meta Quest application that runs entirely on‑device. There are no shared links that launch sessions, no remote code‑execution surface, and no account‑takeover vector via a URL. The app’s core mechanism is dichoptic vision training: because VR headsets feature two independent eyepieces, Amblyotube sends separate visual feeds to each eye simultaneously, turning passive YouTube‑style content into an interactive therapeutic session.

On launch the user selects whether the affected eye is Left or Right; choosing correctly is critical — the wrong choice trains the dominant eye instead. Integrated Condition Presets (Mild, Moderate, Severe) automatically tune the Dominant Eye Shader and Lazy Eye Sharpener for the selected severity.

An on‑board LogMAR vision check tests each eye individually and both together using standardized Landolt‑C optotypes at a virtual 3‑meter distance across up to 30 trials per eye. A clinical staircase algorithm drives the staircase, displays logMAR acuity scores, and can auto‑update the therapy profile to match the detected severity.

The software bundles several specialized tools that stimulate the lazy eye and encourage binocular cooperation:

All of these run locally; the only network traffic is an optional, user‑initiated firmware update check over HTTPS with certificate pinning. No telemetry, no analytics, no cloud inference.

System‑Level Architecture

+-------------------+      +-------------------+      +-------------------+
|  Unity 2022 LTS   | ---> |  OpenXR Runtime   | ---> |  Quest 2/3 GPU    |
|  (URP + Shader    |      |  (Meta XR SDK)    |      |  (Adreno 650)     |
|   Graph)          |      |                   |      |                   |
+-------------------+      +-------------------+      +-------------------+
        |                         |                         |
        v                         v                         v
+-------------------+      +-------------------+      +-------------------+
|  C# Gameplay Loop |      |  Native Plugins   |      |  Display Pipeline |
|  (Therapy Scheduler)      |  (TF‑Lite, FFmpeg) |      |  (Dual‑Eye Render) |
+-------------------+      +-------------------+      +-------------------+

• Unity URP + Shader Graph gives us a single render pass that writes two eye‑specific textures into a single‑pass stereo framebuffer (VRTextureUsage.TwoEyes). This avoids the latency of a double‑render pipeline and keeps the frame budget under 11 ms (90 Hz) on Quest 2.
• TensorFlow Lite runs the figure‑detection model at 30 fps on the DSP, leaving the GPU free for the dichoptic shaders. The model is quantized to int8; inference latency averages 3.2 ms per frame.
• FFmpeg‑based video decoder (hardware‑accelerated via MediaCodec) streams local MP4 assets directly into GPU textures — no intermediate CPU copy.
• Secure storage uses Android’s EncryptedSharedPreferences (AES‑256‑GCM) for therapy profiles; the encryption key never leaves the TEE.

Threat Model & Mitigations

Because the entire pipeline lives inside the Quest sandbox, the attack surface is limited to the OS‑level vulnerabilities that Meta patches quarterly. The app does not request INTERNET permission unless the user enables “Check for updates,” and even then the manifest declares android:networkSecurityConfig="@xml/network_security_config" with certificate pinning to updates.amblyotube.com.

Performance Numbers (Measured on Quest 2, v57)

The headroom (~1 ms) lets us add a future adaptive‑frequency flicker module without dropping frames.

Developer Experience: Adding a New Stimulation Mode

// TherapyScheduler.cs – called once per frame
void Update() {
    if (!sessionActive) return;

    // 1️⃣ Pull latest LogMAR → adjust preset
    var preset = ProfileManager.CurrentPreset;
    shaderController.SetDominantEyeShader(preset.dominantEyeShader);
    shaderController.SetLazyEyeSharpener(preset.lazyEyeSharpener);

    // 2️⃣ Run figure detection on the lazy‑eye texture
    var detection = tfLiteRunner.Detect(lazyEyeTexture);
    shaderController.UpdateSharpenerMask(detection.mask);

    // 3️⃣ Apply flicker if enabled
    if (preset.flickerEnabled)
        shaderController.SetFlicker(preset.flickerHz, preset.flickerDuty);
}

All parameters are driven by a **ScriptableObject* (TherapyPreset) that designers tweak in the Unity inspector — no code changes required for new clinical protocols.*

Why On‑Device Matters for Clinicians & Patients

1. Zero‑trust networking – No session tokens travel over the wire; the only secret is the user’s local profile.
2. Deterministic latency – Therapy timing (e.g., 12 Hz flicker) is guaranteed by the headset’s display refresh, not by network jitter.
3. Regulatory simplicity – FDA’s “Software as a Medical Device” guidance treats on‑device, offline apps as lower‑risk because they lack a cloud‑side attack surface.
4. Data sovereignty – All video assets, logs, and acuity scores stay on the headset; the user can export a CSV via a local file picker if they wish to share with a clinician.

Closing Thought

The ChatGPT link bug reminded the industry that convenience often hides a massive trust assumption. Amblyotube’s design flips that assumption: the only thing you trust is the code you installed, running on hardware you control. For a therapy that rewires the brain’s visual pathways, that guarantee isn’t a nice‑to‑have — it’s a clinical prerequisite.

If you’re building health‑focused XR experiences, start by asking: what would an attacker gain from a single malicious link? Then architect the answer out of the system.

Explore Amblyotube on the Meta Quest Store → https://www.meta.com/experiences/amblyotube/