AI security
ChatGPT Lockdown Mode bypass leaked chats with no click
Check Point escaped ChatGPT's HTML preview sandbox to get around Lockdown Mode and leak chats. OpenAI fixed it; what admins should still set up.
Check Point Research published a way around ChatGPT's Lockdown Mode on November 5. Lockdown Mode is the optional setting OpenAI built to stop prompt injection from sending a user's data to an outside server. The researchers never touched those controls. They escaped the sandbox that renders HTML previews of code blocks, opened a popup the sandbox did not govern, and used it to send a whole chat history to their own server. In the Electron-based ChatGPT desktop app, the victim only had to talk to a malicious custom GPT. No click was needed.
OpenAI fixed it after responsible disclosure and told Check Point on September 18, 2026, that the fix was live. Check Point retested and says the technique no longer works. No CVE or CVSS score has been published. The fix was made on OpenAI's side, so there is nothing to patch, but any organisation that rolled out Lockdown Mode as its answer to prompt injection should know which layer failed and what to put around it.
What Lockdown Mode is meant to block
OpenAI launched Lockdown Mode on February 13, 2026, for ChatGPT Enterprise, Edu, Healthcare and Teachers workspaces, and began rolling it out to personal accounts and self-serve Business workspaces in June. It switches off the features a prompt injection would use to move data out. Web browsing is limited to cached content, so no live request leaves OpenAI's network. Images in responses are blocked, because an image URL with data in its query string is the classic way to leak data. Deep Research, Agent Mode and file downloads for analysis are turned off, Canvas code cannot be approved for network access, and live connector access and connector write actions are blocked.
The threat it targets: hidden instructions in a web page, file or custom GPT get the model to build a link such as attacker.example/collect?data=<private data> and make something fetch it. Lockdown Mode removes every route by which ChatGPT itself would fetch that link.
Some things stay on. Memory, file uploads and conversation sharing still work, and sync connectors that read already-synced data are still allowed. Apps are not switched off automatically. In a managed workspace, admins decide which apps and actions a Lockdown Mode role may use.
How the bypass worked
ChatGPT can render the HTML in a code block as a live preview. The preview runs in two nested iframes kept apart from the main ChatGPT context, so its scripts cannot read the ChatGPT page, its cookies or its local storage. To stop the preview opening windows, ChatGPT's sandbox script replaces window.open. A call with a real URL shows the user an approval prompt, and a call with an empty URL or about:blank silently returns nothing.
That override was the only control. The outer iframe's sandbox attribute still carried two tokens: allow-popups, which lets framed content open new windows, and allow-popups-to-escape-sandbox, which means those windows do not inherit the sandbox's restrictions. The browser itself was willing to open an unrestricted popup. Only a JavaScript wrapper stood in the way.
Check Point went around the wrapper. The attacker's preview page creates one more iframe of its own, and that new frame's contentWindow.open is the browser's original function, not ChatGPT's replacement. Calling it with about:blank opens a blank window, the attacker writes HTML into it, and that HTML runs with no sandbox and none of the preview's network limits. From there it can send whatever it has been given to any server.
How much user action this needs depends on the client. In the Electron desktop app, window.open worked without a user gesture, so the popup appeared and sent the chat with no click. In a normal browser, the popup blocker still needed one click, but automatic file downloads were not blocked.
What attackers could do with it
Check Point demonstrated three outcomes. The first was silent theft of the full chat history to a third-party server during an ordinary conversation in the desktop app. The second was phishing: the popup kept the ChatGPT icon while the attacker set its title and content, which made a fake "ChatGPT update" prompt look real. In the desktop app the popup could also reload the main window and force a sign-out, leading the user to an attacker-controlled login page. The third was malware delivery through that fake update. The desktop app needed one more click to download the file, and browsers needed none.
The way in was any route that puts attacker HTML into a preview: a malicious prompt, a malicious custom GPT, or a shared chat. Shared chats matter because anyone can open one without an account.
There is no public report of this being used against real users. It is also the second ChatGPT HTML preview flaw made public in about a week. On October 28, Parameter Labs described a shared link that could run attacker code in the viewer's ChatGPT session through the same preview feature. OpenAI fixed that one on October 26.
What admins should do now
- Put the right people in Lockdown Mode. In Workspace Settings, create a custom role, mark it as a Lockdown Mode role, and assign the users who handle the most sensitive data. Lockdown Mode cannot be on at the same time as Developer Mode, so decide which of the two each group needs.
- Keep the app list short. Lockdown Mode does not disable apps, MCP servers or connectors for you. For the Lockdown role, enable only the apps and actions those users need. OpenAI advises against read and write actions in untrusted apps. Write actions carry the most risk, because their side effects can be seen from outside.
- Control custom GPTs and shared chats. Every route Check Point used started with content the user did not write. Limit which third-party GPTs your workspace allows, and treat shared ChatGPT links from outside the organisation like any other untrusted link in mail and chat filtering.
- Check the desktop app. The zero-click path was in the Electron app. Make sure only current, managed builds are installed, and decide whether the browser, with its popup blocker, is the better client for your most sensitive users.
- Limit what reaches ChatGPT. Use your data classification labels and data loss prevention rules to keep restricted data out of prompts and uploads. Review app usage, shared data and connected sources in the Compliance API Logs Platform, which OpenAI points admins to for this.
To look for past abuse, start with the app usage and shared data the Compliance API Logs Platform records. Web proxy and firewall logs can show desktop or browser clients making requests to unfamiliar domains straight after a ChatGPT session. Without indicators from Check Point, treat that as a search for anomalies, not a match against a list.
The wider lesson
Lockdown Mode did what it says: it removed the model's own ways of making network requests. The leak came from a rendering feature next to the model, enforced by a function override instead of the browser's sandbox. When you assess an AI assistant, test the client, previews, connectors and desktop wrapper as well as the prompt filters, and assume one of them will fail.
We test AI assistants and the apps and connectors around them as part of AI-native systems work, and review workspace settings like these in safeguarding and hardening. If you want to know how your ChatGPT workspace would hold up, open the chat and Yaali, our AI agent, will pass your question to an engineer.
Sources: Check Point Research, Check Point blog, The Hacker News, IT Nerd, OpenAI, Help Net Security (February), Help Net Security (June), Gend, The Hacker News (Parameter Labs), MIXED.