I think in this situation it would be best to admit that it was improper behavior. You can agree that you should have either - used your own site - or someone

I think in this situation it would be best to admit that it was improper behavior. You can agree that you should have either - used your own site - or someone that explicitly agreed to run this experiment. Then you can go on that you regret your wrong approach in this case, you will do better next time and finally point out that very little damage was done, which you regret nonetheless. Then we all move on, - agree that it is an interesting hack - and the web browser is a terrible platform security wise.