Check Point found a bypass in ChatGPT Lockdown Mode

OpenAI added HTML page previews to ChatGPT code blocks in February 2026.[1] The preview sandbox was designed to isolate user-controlled content from the main application and prevent direct access to app data such as cookies and local storage.[1] Check Point researchers said nested sandboxed frames allowed popups to escape the sandbox, and another nested frame let them access an unmodified popup function.[2] They said content opened through that popup route was no longer subject to the same sandbox restrictions.[2] The findings point to a weakness in how the preview and popup components interacted, rather than a failure of the intended isolation alone.[1][2]

The researchers said attackers could use a malicious prompt, a malicious GPT or a shared chat to launch an attack.[1] In ChatGPT Classic, they said simply having a conversation was enough to trigger it.[1] They demonstrated a malicious GPT silently leaking chat messages to an attacker-controlled server.[1] The researchers also said the flaw could manipulate the Classic interface, including by displaying popups with arbitrary content.[1] In the app, a popup retained the ChatGPT icon even though an attacker could control its title.[1] However, downloading a file in the app still required the victim to click a link.[1]

Check Point said the potential consequences included exfiltration of entire chat histories and uploaded files, phishing-based credential theft, and malware disguised as a legitimate update.[1] The researchers said the flaw was not limited to the desktop environment.[3] OpenAI told Check Point on September 18, 2026, that it had deployed a fix removing popup permissions from the outer HTML-preview sandbox iframe.[1] Check Point Research said it retested the issue and confirmed that the described exploitation technique no longer worked.[1] The evidence describes that technique and fix; it does not establish the status of other possible vulnerabilities or the configuration of a particular organization’s deployment.

Check Point said the flaw illustrated how weaknesses elsewhere in an application can undermine AI security controls.[2] The researchers’ account connects an intended data-isolation feature with popup behavior that created a route around its restrictions.[1][2] Check Point also said organizations should gain visibility into AI usage and where corporate information is being shared.[4] For teams handling sensitive material, the practical takeaway is to treat a security setting as one layer of protection, not as a substitute for understanding how AI tools are used and where information goes. This is a risk-management implication, not a claim that the reported attack occurred at any particular organization.