Check Point Research has disclosed a now-fixed flaw that let an attacker get around ChatGPT’s Lockdown Mode, the optional setting OpenAI introduced in June 2026 to limit how data can leave a conversation if a prompt injection succeeds. Lockdown Mode restricts web access to cached content, blocks loading images from the internet, disables network requests from Canvas-generated code, and turns off features such as Deep Research, Agent Mode, live connectors and file downloads. Check Point’s researcher Alexey Bukhteyev found that a different feature, the HTML page preview that OpenAI added to ChatGPT code blocks in February 2026, offered a way around those limits.
The preview renders HTML inside two nested sandboxed frames, and ChatGPT intercepts attempts to open new windows. But the frames still carried the allow-popups and allow-popups-to-escape-sandbox permissions. By creating one more nested frame inside the previewed page, the researchers reached an unmodified window.open function and opened a popup that was no longer subject to the sandbox or to Lockdown Mode. Check Point says an attacker could deliver this through a malicious prompt, a malicious GPT, or a shared chat. The popup keeps the ChatGPT app’s icon while the attacker controls its title and content, so it could carry a fake “update” that installs malware or a lure that steals credentials. In the browser, a shared chat was enough and the victim did not need an account. In the Electron-based ChatGPT Classic desktop app, window.open worked without a user click, which Check Point says made silent theft of the whole chat history possible just by having a conversation, and let the page reload the main window, for example to sign the user out and prompt a fresh login on an attacker’s page.
Check Point reported the issue to OpenAI, which said on September 18, 2026 that it had removed the two popup permissions from the outer preview frame; Check Point retested and confirmed the technique no longer works. The Hacker News adds that this is one of several recent ChatGPT sandbox findings, including a Parameter Labs report of an account takeover through a shared-chat link and an earlier Check Point cross-account channel. Check Point does not report any exploitation in the wild.
Sources
- Check Point Research: ChatGPT Lockdown Mode Bypass: Phishing, Malware Delivery, and Silent Data Exfiltration
- The Hacker News: Researchers Bypass ChatGPT Lockdown Mode to Exfiltrate Chats Without User Interaction
- OpenAI Help Center: Lockdown Mode (returned 403 to automated fetching; linked from The Hacker News, not read directly)