Check Point finds a way around ChatGPT's Lockdown Mode, now fixed

What Check Point found

Security company Check Point has published details of a weakness that let attackers get around Lockdown Mode in ChatGPT. Lockdown Mode is a protective setting that users can choose to turn on. According to the report, the weakness could allow conversation data to be pulled out, or let a user be redirected to a phishing site, meaning a fake page built to trick people into handing over information.

The most worrying detail concerns the desktop version of ChatGPT. There, the leak could be "zero-click," which means data could be taken without the user doing anything at all. No button press, no approval, no mistake on the user's part was needed.

As note reported, Check Point followed responsible disclosure. That is the normal practice in which researchers tell the company about a flaw privately and give it time to fix the problem before going public.

What Lockdown Mode is supposed to do

OpenAI introduced Lockdown Mode in June 2026 as an optional setting. Its purpose is to cut the risk of data leaking through prompt injection. That is a trick in which hidden instructions are slipped into content an AI reads, with the aim of making the AI do something its user never asked for.

The mode works by limiting how ChatGPT can communicate with the outside world. The logic is simple: if sensitive information cannot be sent out, an attacker who manages to steer the AI has nowhere to send what they want to steal. It is a bit like closing the doors of a room so that nothing can be carried out, even if someone gets inside.

How the bypass worked

Check Point says the restrictions could be sidestepped through the HTML preview feature in ChatGPT's code blocks. A code block is the boxed area where ChatGPT shows programming code, and an HTML preview lets that kind of content be displayed as a rendered page rather than as plain text.

In plain terms, a feature designed to show you something helpful gave a way to reach beyond the limits Lockdown Mode had set. Through that route, the researchers say, conversation data could be stolen or a user could be sent to a phishing page.

The source does not go further into the technical steps, and neither will we. It also does not say how many people were affected or whether anyone used the flaw in real attacks, so those questions remain open.

The fix, and what is still unknown

OpenAI addressed the issue on September 18. Because the fix is already out, the main action for users is simple: keep your ChatGPT apps up to date so you receive patches like this one.

The article that reported the story does not include any comment from OpenAI. That means we do not have the company's own account of how serious the problem was, how it was fixed, or whether it plans changes to how Lockdown Mode is built and tested.

The timing also matters for context. The patch came on September 18, while the public write-up has arrived later. That gap is typical of responsible disclosure, but it means readers learn about such problems after the danger has, in theory, already passed.

A lesson about safety settings

The summary offered by the source is blunt: a defense setting is a way of reducing risk, not a promise of safety. That is a useful way to think about nearly every protective switch in any software, not just AI tools.

For everyday users, this points to a few sensible habits:

• Keep AI apps updated so fixes reach you quickly.
• Think before you paste private or sensitive material into a chat, even with protections on.
• Treat a safety mode as one layer of defense, not the only one.

None of this means Lockdown Mode is pointless. It was built to shrink a real risk, and a flaw in it was found and fixed. But the episode shows why independent researchers testing these protections matters, and why users should not hand over more than they would be comfortable losing.