Security researchers have disclosed a flaw that bypassed ChatGPT's Lockdown Mode, the setting meant to stop prompt-injection attacks from stealing private data. Check Point Research found that a popup escaping the chat's HTML preview sandbox could silently send a full chat history to an attacker's server, show fake sign-in windows, and deliver malware. OpenAI fixed the flaw on September 18, seven weeks before the details went public, and researchers confirmed the technique no longer works.
What Lockdown Mode does
Lockdown Mode is an optional security setting for logged-in ChatGPT users. It is designed for people handling sensitive data, and it cuts off the channels through which data could leave a conversation. When enabled, it limits live web access to cached content, blocks images from the internet, and turns off Deep Research, Agent Mode, connectors, Canvas networking, and file downloads.
How the bypass worked
The flaw sat in the HTML preview that ChatGPT added to code blocks in February 2026, which renders generated web code inside a sandbox of two nested frames. The sandbox allowed popups, and ChatGPT guarded them by replacing the standard window.open command with its own version that asks the user for approval.
But the guard covered only the top-level page, not a further nested frame inside it. By creating one more nested frame and calling its untouched window.open, an attacker could open a popup that ran outside the sandbox entirely, beyond the reach of Lockdown Mode.
What an attacker could do
The escaped popup could carry a full chat history and uploaded files to an attacker's server, and it kept ChatGPT's application icon while the attacker controlled the title. That made it a convincing lure for phishing: a fake sign-in window inside a trusted-looking app, or a prompt to download malware disguised as an application update.
A malicious prompt, a malicious GPT, or a shared chat could all set it off. In a browser, a reader without an account could be caught by a shared chat holding a malicious page, since the victim only had to click a preview that looked harmless.
The desktop app was worse. In ChatGPT Classic, the Electron-based desktop application, window.open worked without any user gesture, so simply holding a conversation with a malicious GPT could leak messages silently. Researchers also found they could reload content in the main application window and force a sign-out, setting up a lure to re-authenticate on an attacker-controlled page.
Check Point reported the flaw to OpenAI privately. On September 18, OpenAI said it had removed the allow-popups and allow-popups-to-escape-sandbox permissions from the outer preview frame, and Check Point retested the technique and confirmed it no longer works. The fix is server side, so users do not need to install anything or change a setting.
Our Read
The disclosure is a reminder that ChatGPT's safety features are only as strong as the least-guarded surface around them. Lockdown Mode was built to close outbound channels, yet the HTML preview — a convenience feature for rendering code — opened a new one that the mode never covered.
The flaw was real and the demonstration is striking, but the risk today is historical: the fix landed seven weeks before publication, and no user action is needed. What should linger is the pattern, not the panic — every new capability ChatGPT gains, from code previews to connectors, widens the surface an attacker can probe.
This is Check Point's second ChatGPT sandbox escape this year: an earlier report showed conversation data leaving through DNS tunnelling in the code-execution runtime. Anthropic's Claude Code has faced its own run of similar disclosures, from email addresses leaking into headers to secrets landing on GitHub.
The lesson is the same on both sides: as chatbots become execution environments that run code and render pages, the app around the model deserves as much scrutiny as the model itself. A safety mode that covers the chat but not the preview is a lock on the front door with the window open.
Why It Matters
Lockdown Mode exists for the users with the most to lose — people who paste medical records, financial data, or company secrets into ChatGPT and trust the setting to keep them there. A bypass that could silently copy a whole conversation, with no click needed in the desktop app, undercut exactly that promise.
The fix is in place, but the disclosure should push OpenAI to audit every surface Lockdown Mode is supposed to cover, not just the ones it was designed around. For users, the practical advice stands: treat the app, its runtime, and its connectors as part of the attack surface, and limit what sensitive data goes into any chatbot.
Background
Check Point disclosed an earlier ChatGPT flaw this year, in which conversation data left the code-execution runtime through DNS tunnelling, which OpenAI also fixed. The HTML preview here arrived in February 2026, and Lockdown Mode launched the same month, first for business plans. Check Point's report was published on November 5, after the September 18 fix and a retest.
Source: Check Point Research's full report and Notebookcheck's report
0 Comments