Check Point bypasses ChatGPT Lockdown Mode, with chats leaked without user interaction in the desktop app

TLDR

• Check Point says a ChatGPT HTML preview flaw could bypass Lockdown Mode, enabling chat theft, phishing and malware delivery.¹²
• In the desktop app, a malicious GPT could leak chat messages with no user interaction, Check Point demonstrated.¹²
• OpenAI told Check Point it deployed a fix on 18 September; Check Point confirmed the technique no longer works.¹

Check Point Research has disclosed a vulnerability that bypassed Lockdown Mode, the optional ChatGPT setting meant to reduce prompt-injection data theft, and says it could enable silent theft of chat data, phishing and malware delivery.¹² The Hacker News, which was given the report, describes the flaw as now patched.³ Check Point says Lockdown Mode restricts live web access to cached content, blocks images loaded from the internet, disables network requests from Canvas-generated code, and turns off Deep Research, Agent Mode, live connectors and file downloads.¹ OpenAI's help article says the setting is designed to limit outbound network requests that could carry data to an attacker, and that it does not stop prompt injections from appearing in content ChatGPT processes.⁴ The Hacker News says Lockdown Mode was introduced in June 2026, while OpenAI's announcement says it was first introduced for enterprise plans on 13 February 2026 and rolled out to personal and self-serve Business accounts from 4 June.³⁵

The flaw sat in the HTML page preview that ChatGPT added to code blocks in February 2026, according to Check Point.¹ The preview runs rendered HTML inside two nested iframes, and Check Point says their sandbox attributes still carried the allow-popups and allow-popups-to-escape-sandbox permissions.¹ ChatGPT redefined window.open so that popups needed user approval or returned nothing, but Check Point says creating one more nested iframe inside the rendered page and calling its own window.open worked, and the popup it opened was no longer subject to the sandbox.¹ Check Point says an attack could be delivered through a malicious prompt, a malicious GPT or a shared chat.¹²

Check Point says window.open in the Electron-based ChatGPT Classic app works without a user gesture, so simply holding a conversation was enough to trigger exfiltration, and it demonstrated a malicious GPT sending chat messages to an attacker-controlled server.¹ It also says the main application window could be reloaded and the user forcibly signed out, which could be used to steal credentials on an attacker-controlled page.¹ The popup kept the ChatGPT app icon while the attacker controlled its title and content, which Check Point used to show a fake update that pushed malware, although in the desktop app the victim still had to click a download link.¹² In a browser, Check Point says the attacker needs the victim to click a generated preview, downloads are not blocked, and the victim does not need an account if the lure is a shared chat.¹ Check Point's blog says the technique is not limited to the desktop environment.²

Check Point says OpenAI told it on 18 September 2026 that it had removed the allow-popups and allow-popups-to-escape-sandbox permissions from the outer HTML-preview iframe, and that its retest showed the technique no longer works.¹ The Hacker News also gives 18 September as the fix date.³ The Polish outlet dailyAI notes that the report gives no date for the original disclosure to OpenAI and no count of accounts exposed, and does not say whether the flaw was used before the fix.⁶ It also says the fix was made on OpenAI's side, so the report names no action for users.⁶ The Hacker News adds that the disclosure comes a week after Parameter Labs detailed a separate bypass of ChatGPT's sandbox and content security policy through a public share link.³

Why it matters: Check Point says the weakness was in an ordinary app feature rather than the model, so a control meant to stop data leaving a chat was only as strong as the application around it.²