Researchers Bypass ChatGPT Lockdown Mode to Exfiltrate Chats Without User Interaction

Lockdown Mode was introduced by OpenAI in June 2026 as an optional setting to minimize data exfiltration risks arising from prompt injections. The feature acts as a security barrier by limiting outbound network requests that could transfer sensitive information to an attacker-controlled infrastructure. However, a new vulnerability discovered by researchers at Check Point undermines these protections.

The problem stems from HTML page previews inside ChatGPT code blocks, which allow HTML content to be rendered directly within the application. Given that executing user-supplied HTML and JavaScript can introduce security risks, the content is placed inside a sandbox so that it cannot access data from the app, such as cookies and local storage. The sandbox also prevents the rendered content from communicating with external resources without user consent.

Check Point found a loophole in the manner popup windows are handled during HTML previews that made it possible to escape the confines of the sandbox and bypass Lockdown Mode. The HTML preview used nested sandboxed frames, and while ChatGPT intercepted direct attempts to open new windows, the underlying sandbox permissions still allowed popups and permitted them to escape the sandbox.

Once the restrictions are bypassed, a threat actor can exploit the vulnerability to exfiltrate data, chat messages, or deliver malicious payloads by means of a crafted prompt, a malicious GPT, or a shared chat. The attacker is in complete control of the content displayed in the popup window, which could be used to render convincing social-engineering lures, such as a fake ChatGPT update, and trick the victim into downloading malware by persuading them to click on a link.

The underlying issue is not limited to the Electron-based desktop environment, highlighting how weakness outside of the scope of the AI model can undermine AI security controls. Following responsible disclosure, the vulnerability was addressed by OpenAI on September 18, 2026.

The disclosure comes a week after Parameter Labs detailed a way to bypass ChatGPT's sandbox and content security policy (CSP) and take over anyone's account simply by sending an attacker-controlled public ChatGPT share link and prompting them to click the HTML preview once. If the HTML block is marked as previewable, it's opened automatically.

Earlier this September, Check Point also demonstrated a covert cross-account command channel through which an attacker could use a victim's ChatGPT session to run hidden tasks with the tools, data, and connected apps available to that session, alongside the visible conversation. The victim could receive a normal answer to their visible request while the attacker's task was processed separately and its result returned across accounts.

The findings coincide with the discovery of a number of security shortcomings in various AI-driven tools and services over the past months to trick them into spilling secrets or carrying out unauthorized actions. These include SkillJacking, Embrace, Repeat-After-Me, AgentCorruption, Cryptographic Context Injection, SalesBleed, not-a-mused, Plugin4Shell, BragJack, sampling drift, and PleaseFix.

Lockdown Mode was specifically intended to reduce the possibility of data leaving a conversation through potentially malicious outbound requests, yet a weakness in another application feature provided an alternative path around that security boundary. The finding raises a broader enterprise security issue: AI security controls are only as strong as the wider application environment around them.