Security flaw in ChatGPT Lockdown Mode could expose private chats

The Lockdown Mode vulnerability

OpenAI recently introduced a feature called Lockdown Mode to enhance the security of the ChatGPT platform. This mode is designed to protect sensitive application data by restricting outgoing network requests that could be exploited by malicious actors. By limiting these connections, the system aims to prevent private information from being sent to unauthorized external websites.

However, researchers at the cybersecurity firm Check Point discovered a significant security flaw within this new feature. Despite the added layer of protection, the vulnerability allowed attackers to bypass the security measures entirely. As Digit reported, this flaw could have exposed private conversations and left users vulnerable to various types of cyberattacks.

The security firm identified that the weakness was not limited to a single platform. The vulnerability was present in the entire ChatGPT application environment, meaning it could affect users across different devices and interfaces. This broad reach made the flaw a significant concern for anyone utilizing the AI's advanced security settings.

How the sandbox was bypassed

To understand the flaw, it is necessary to look at how ChatGPT handles HTML previews inside code blocks. When users preview HTML content, the system places that content inside a sandbox. A sandbox is a restricted environment that prevents the code from accessing internal information or communicating with unauthorized external sites.

The researchers found that the issue was specifically linked to how popup windows were handled within these previews. While the primary preview was restricted, attackers could use nested frames within an HTML preview to reach a popup function. This specific function was not subject to the same security restrictions as the original preview environment.

By exploiting this gap, malicious content could effectively escape the sandbox. This escape allowed the code to bypass Lockdown Mode's protections. Because the popup function lacked the necessary restrictions, it provided a pathway for unauthorized actions to occur outside of the intended secure zone.

Potential risks to users

Once an attacker successfully bypasses the security restrictions, the risks to the user become substantial. The flaw could enable threat actors to access and steal private chat messages or extract other sensitive information from the session. These actions could occur without the user taking any deliberate action on their part.

Beyond data theft, the vulnerability could be used to facilitate phishing attacks. Attackers could use the popup windows to display fake ChatGPT update messages or other convincing prompts. These messages could trick users into downloading malware or providing credentials to a fraudulent site.

The researchers noted that these attacks could be triggered in several ways. A user might be targeted through a carefully designed prompt, a malicious custom GPT, or even a shared ChatGPT conversation. Each of these vectors provides a potential entry point for an attacker to exploit the underlying HTML preview flaw.

Response and remediation

The discovery of the flaw was made possible through a process known as responsible disclosure. This is when security researchers find a bug and report it privately to the company so it can be fixed before the public becomes aware of the risk. Check Point reported the details to OpenAI, allowing the company to address the issue internally.

OpenAI acted quickly to secure the platform following the report. The company confirmed that the vulnerability was fixed as early as September 18, 2026. This rapid response ensured that the gap in Lockdown Mode was closed before it could be widely exploited by malicious actors.

While the flaw has been patched, the incident highlights the ongoing challenge of securing complex AI environments. As features like Lockdown Mode become more common, the interaction between nested code elements and security sandboxes requires constant monitoring. The fix ensures that the current version of ChatGPT maintains the integrity of its security promises.