Check Point Research disclosed on November 5, 2026 a flaw that let attackers bypass ChatGPT's Lockdown Mode and send chat data to an outside server. OpenAI fixed it on September 18, 2026, before publication.
Lockdown Mode is an optional setting for logged-in users. It limits the channels prompt injection could use to leak data: web access is restricted to cached content, external images are blocked, Canvas code cannot make network requests, and Deep Research, Agent Mode, live connectors and file downloads are off.
The weak point was the HTML preview in ChatGPT code blocks, added in February 2026. Previews ran inside two nested sandboxed iframes. ChatGPT replaced the window.open function so popups needed user approval, but the sandbox still allowed popups and allowed them to escape the sandbox.
The researchers created one more iframe inside the preview and used its own open function. That produced a real popup, outside the sandbox and outside Lockdown Mode.
Check Point demonstrated silent exfiltration of a chat history, phishing for credentials and malware disguised as an app update. In the Electron-based ChatGPT Classic app, popups opened without any click, so a conversation alone could trigger the leak. The attack could arrive through a malicious prompt, a malicious GPT or a shared chat.
OpenAI removed the two popup permissions from the outer preview iframe. Check Point retested and confirmed the technique no longer works.
Why this matters
A security mode is only as strong as the features around it. Lockdown Mode closed the obvious channels, and a convenience feature reopened one. Teams that give AI tools access to sensitive data should review every rendering and preview path, not only the settings page.
Sources: Check Point Research.
This article is not legal advice.
