Research found a flaw that bypassed ChatGPT’s Lockdown Mode. It let attackers silently exfiltrate full chat histories, deliver malware, and phish credentials from inside a trusted interface.
Researcher Alexey Bukhteyev published the findings on November 5, 2026. In the ChatGPT Classic desktop app, simply having a conversation triggered the leak.
OpenAI built Lockdown Mode as an optional advanced setting to limit prompt-injection-based data theft. It restricts browsing to cached content and blocks web images.
It also turns off Canvas networking, Deep Research, Agent Mode, live connectors, and file downloads. The goal is to close every channel through which data could leave a conversation, even if an injected prompt succeeds. The bypass made those protections ineffective.
ChatGPT Lockdown Mode
In February 2026, OpenAI added an HTML page preview to ChatGPT code blocks. Rendering attacker-influenced HTML and JavaScript is risky, so OpenAI placed it in two nested sandboxed iframes. The sandbox intercepted external requests, remote images, links, and popups, and showed approval dialogs.
The weakness was in the iframe permissions. The outer sandbox allowed both allow-popups and allow-popups-to-escape-sandbox. To compensate, OpenAI’s scripts overrode window.open so popups needed user approval. Calls with an empty or about:blank URL returned null.
Check Point Researchs found that the override only covered the top-level page. A script could create another nested iframe and call its contentWindow.open to obtain a genuine popup. Because the sandbox allowed popups to escape, the new window ran arbitrary HTML outside the sandbox. That bypassed both the preview restrictions and Lockdown Mode.
Phishing, Malware, and Zero-Click Theft
The spoofed popup keeps ChatGPT’s icon while the attacker controls the title, so users believe they are still inside the app. Attackers could offer malware disguised as a ChatGPT update.
The desktop app blocks automatic downloads, so victims must click a link. Browsers do not block downloads, and victims need no account. Sharing a chat that contains a malicious page is enough, which makes clicking content in shared chats dangerous.
The most serious finding involved the Electron-based ChatGPT Classic app, where window.open worked without any user gesture. A malicious prompt, malicious GPT, or shared chat could silently send chat messages to an attacker’s server with no interaction.
Researchers also reloaded the main application window and forced sign-outs. An attacker could then lure victims into re-entering credentials on a fake login page.
This follows a run of ChatGPT exfiltration research. Earlier, a ChatGPT vulnerability enabled silent prompt leakage through a hidden outbound channel in the code-execution runtime.
Check Point detailed that DNS-tunneling flaw in its own write-up. OpenAI’s guidance on URL-based exfiltration explains why a link such as attacker.example/collect?data=
Check Point responsibly disclosed the issue. On September 18, 2026, OpenAI said it had removed the allow-popups and allow-popups-to-escape-sandbox permissions from the outer HTML-preview iframe. Researchers retested and confirmed the technique no longer works.
AI assistants now act as full execution environments, running code in the cloud and rendering content on the client while handling medical, financial, and other sensitive data. Each convenience feature widens the attack surface.
Related risks keep appearing, including a ChatGPT flaw that exposed Gmail data across accounts. Guardrails help but offer no guarantee. Users should avoid clicking content in shared chats and think carefully before giving AI sensitive data. Defenders should assess the whole platform, including layers users never see.
Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.
