Security flaw allows bypass of ChatGPT Lockdown Mode to leak data

The Lockdown Mode bypass

OpenAI recently introduced Lockdown Mode as an optional security setting for logged-in users. This feature is intended to protect sensitive data by restricting the AI's ability to make outbound web, app, or file-download requests. It aims to stop prompt injection attacks where a user is tricked into letting the AI send private information to an external server.

However, Check Point Research discovered a vulnerability that renders these protections ineffective. The flaw allows attackers to circumvent the restrictions placed on the AI's environment. By exploiting a specific rendering feature, malicious actors can still move data out of the conversation without the user's knowledge.

The research team demonstrated that the vulnerability creates a wide attack surface for various threats. Beyond just leaking text, the flaw could be used to steal credentials or deliver malicious software. This finding suggests that even advanced security layers can have hidden weaknesses if the underlying architecture is not perfectly isolated.

How the exploit works

The vulnerability stems from how ChatGPT handles HTML page previews within code blocks. While OpenAI uses a sandbox to separate user-controlled HTML from the main application, the sandbox was configured with permissive tokens. Specifically, the sandbox allowed popups to escape its restrictions, creating a loophole for attackers to exploit.

To bypass the security, an attacker can create a nested iframe inside the sandboxed page. By using the contentWindow.open function of this nested iframe, they can trigger a popup that is no longer restricted by the sandbox. This allows the attacker to execute arbitrary HTML code in a window that the ChatGPT interface treats as a trusted context.

Once the popup is opened, the attacker can place content that interacts with the rest of the application. Because the popup escapes the sandbox, it can perform actions that Lockdown Mode is supposed to block. This technical oversight allowed for the covert transfer of entire chat histories and uploaded files to external servers.

Phishing and malware risks

The exploit provides several methods for social engineering and malicious activity. Attackers can craft a malicious GPT or a shared chat that contains a preview of a fake page. This page can display a popup window that retains the ChatGPT application icon, making it look like a legitimate part of the software.

Users might see a prompt asking them to download a fake application update or click a link to authenticate their account. Because the window looks official, it creates a high risk of credential theft or malware installation. In some cases, the attacker can even force a user to sign out of their account to facilitate these lures.

The risk is particularly high in the ChatGPT Classic application. In this version, the window.open function can work even without a physical gesture from the user. This means a conversation alone could be enough to trigger the attack, leading to silent data exfiltration without any clicks or interaction from the victim.

Impact on users and data

The potential impact of this flaw covers a broad range of sensitive data types. Since AI assistants are increasingly used for medical records and financial data, the ability to exfiltrate chat history is a significant concern. The vulnerability allows for the theft of private data even when the user believes they are operating in a secure mode.

The research highlights that the attack can be triggered through multiple vectors. A user might unknowingly interact with a malicious GPT, a shared chat link, or a specific prompt designed to trigger the HTML preview. Each of these paths provides a way for an attacker to reach the victim's data through the trusted ChatGPT interface.

While the vulnerability is now patched, it underscores the complexity of securing AI environments. As these systems evolve into full execution environments, every new convenience feature expands the potential attack surface. Users are reminded to be cautious about granting AI agents full access to sensitive files or personal information.

OpenAI's response and fix

Check Point Research responsibly disclosed the security flaw to OpenAI for remediation. The company responded by deploying a fix on September 18, 2026. This update specifically removed the allow-popups and allow-popups-to-escape-sandbox permissions from the outer HTML-preview sandbox iframe.

Following the patch, the research team retested the exploitation technique and confirmed it no longer works. This fix closes the specific loophole that allowed nested iframes to escape the sandbox and trigger unauthorized popups. It restores the integrity of the Lockdown Mode protections for users who have it enabled.

The incident serves as a case study on the importance of rigorous sandbox testing. As AI platforms continue to add features like live connectors and deep research, constant auditing is necessary. Security experts suggest looking at the platform as a whole rather than relying on individual features to guarantee safety.