Cybersecurity researchers at Check Point have disclosed details of a now-patched vulnerability that could bypass Lockdown Mode protections in OpenAI’s ChatGPT, potentially enabling unauthorised access to conversation data, phishing attempts and malware delivery. Lockdown Mode was introduced in June 2026 as an optional security setting designed to reduce data exfiltration risks associated with prompt injection attacks. It provides additional safeguards by limiting outbound network requests that could otherwise allow malicious content to transfer sensitive information to attacker-controlled infrastructure. According to Eli Smadja, Head of Research at Check Point, the vulnerability could enable silent chat data theft, phishing and malware delivery, including zero-click data exfiltration in the ChatGPT desktop application. The issue originated in the way ChatGPT handled HTML page previews inside code blocks. These previews allow HTML content to be rendered within the application, but the content is placed inside a sandbox to prevent it from accessing sensitive application information, such as cookies and local storage, or communicating with external resources without user consent. Check Point found that a weakness in popup window handling could create a route around these restrictions, allowing malicious content to bypass protections intended to limit unauthorised activity.
The researchers discovered that ChatGPT’s HTML previews used nested sandboxed frames. Although the application intercepted direct attempts to open new windows, the underlying sandbox permissions still allowed certain popup behaviour. By creating another nested frame within the rendered page, researchers could access an unmodified popup function and bypass restrictions applied to the original preview. Content opened through this route was no longer subject to the same sandbox protections, potentially allowing attackers to transfer conversation data or deliver malicious content. According to Check Point, the vulnerability could be exploited through a crafted prompt, a malicious custom GPT or a shared ChatGPT conversation. An attacker could also control the content displayed in the popup window and use it to create convincing social-engineering pages, including a fake ChatGPT update notification designed to persuade users to download malware. The researchers highlighted that the issue was not limited to the Electron-based desktop environment, although zero-click data exfiltration was a particular concern in the desktop application. These findings demonstrate how weaknesses in application features surrounding an AI model can undermine security controls, even when those controls are specifically designed to protect sensitive conversations and restrict external communication.
Following responsible disclosure, OpenAI addressed the vulnerability on September 18, 2026. Check Point reported that the company deployed a fix and that subsequent testing confirmed the described bypass no longer worked. The disclosure also follows a separate investigation by Parameter Labs, which identified another ChatGPT security weakness involving shared conversation links, HTML previews and browser security controls. That research described how an attacker could create a malicious conversation, publish it through ChatGPT’s sharing feature and send the link to another user. Under the demonstrated conditions, opening the shared conversation could allow attacker-controlled JavaScript to execute within the victim’s authenticated ChatGPT session. Check Point clarified that the two findings involved different vulnerabilities affecting the same general component. The shared-link issue enabled JavaScript execution outside the sandbox and could potentially allow actions to be performed through the victim’s authenticated session, while the Lockdown Mode finding involved bypassing restrictions on popup behaviour and outbound communication. The distinction is important because the two reports describe separate technical weaknesses rather than a single vulnerability. Together, however, they highlight the security challenges associated with features that render external or user-controlled content within AI applications.
The findings come amid growing research into vulnerabilities affecting AI-powered tools, coding assistants, autonomous agents and enterprise workflows. Recent investigations have identified different techniques that could expose sensitive information, trigger unauthorised actions or manipulate AI systems through malicious prompts and untrusted content. These include attacks involving embedded browsers, agent plugins, software dependencies, customer support assistants and connected enterprise services. Other research has examined how prompt injection can influence AI agents that have access to files, credentials, applications and privileged tools. Security researchers have repeatedly warned that the growing use of AI agents in development, messaging, incident response and business operations increases the importance of controlling their permissions and verifying the instructions they process. Check Point’s findings reinforce the need to secure the broader application environment around AI models, including sandbox boundaries, popup handling, browser components and integrations. For organisations using AI platforms, the reports highlight the importance of keeping applications updated, reviewing access to connected services and limiting the sensitive information shared through AI conversations. Although OpenAI has addressed the Lockdown Mode bypass described by Check Point, the wider research demonstrates that AI security requires continuous testing of both model-level safeguards and the software features that support them.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
