Check Point bypassed ChatGPT Lockdown Mode via an HTML-preview sandbox flaw, enabling zero-click chat exfiltration

What happened

• 5 November 2026: Check Point Research, in work by Alexey Bukhteyev, published a bypass of ChatGPT Lockdown Mode, an optional setting it describes as designed to protect sensitive data “from prompt injection-based exfiltration attacks” (Check Point Research). Lockdown Mode limits live web access to cached content, blocks internet images, disables network requests from Canvas-generated code, and turns off Deep Research, Agent Mode, live connectors and file downloads (Check Point Research).
• The flaw sits in the HTML page preview feature OpenAI added to ChatGPT code blocks in February 2026. The preview renders HTML inside two nested sandboxed iframes meant to block outside images, scripts and links (Check Point Research; Cyber Security News).
• The outer iframe’s sandbox included the tokens allow-popups and allow-popups-to-escape-sandbox. ChatGPT’s scripts overrode window.open to require user approval, but only on the top-level page; calls with an empty URL or about:blank silently returned null (Check Point Research; GBHackers).
• Check Point found that a page could create another nested iframe and call that iframe’s own contentWindow.open to obtain a genuine popup that bypassed the override. Because of the escape token, HTML in the new window ran outside the sandbox, defeating both the preview restrictions and Lockdown Mode (Check Point Research; GBHackers).
• Zero-click exfiltration. In the Electron-based ChatGPT Classic desktop app, window.open works without a user gesture, so “simply having a conversation is enough to trigger the attack” (Check Point Research). A malicious prompt, a malicious custom GPT, or a shared chat could silently send the full conversation, and uploaded files, to an attacker-controlled server (Cyber Security News; GBHackers).
• Phishing and malware. A spoofed popup kept ChatGPT’s icon while the attacker controlled the title and content, letting malware be disguised as an app update. ChatGPT Classic does not auto-download files so a click is still needed, but in a browser downloads are not blocked and the attack could work through a shared chat with no account required of the victim (Check Point Research; Cyber Security News).
• Credential theft. The technique could also reload the main ChatGPT window and force a sign-out, then present a fake login page to capture the password at re-entry (Check Point Research; GBHackers).
• No CVE identifier, CVSS score or affected version numbers are given in the sources (The Hacker News; GBHackers).

What to do

• Update the ChatGPT desktop app. OpenAI deployed a server-side fix on 18 September 2026, removing allow-popups and allow-popups-to-escape-sandbox from the outer HTML-preview iframe, and Check Point confirmed the technique no longer works; no user action is required for this specific bug, but keep the app current (Check Point Research; Cyber Security News).
• Don’t click buttons, previews or “update” prompts inside shared chats, and avoid prompts copied from unknown sites or custom GPTs from unknown builders (Cyber Security News).
• Check the address bar or sign-in page before entering a password, especially after an unexpected logout (Cyber Security News).
• Avoid pasting sensitive medical, financial or work data into chats unless necessary (Cyber Security News).

Sources

• Check Point Research: ChatGPT Lockdown Mode Bypass: Phishing, Malware Delivery, and Silent Data Exfiltration (5 November 2026)
• The Hacker News: Researchers Bypass ChatGPT Lockdown Mode to Exfiltrate Chats Without User Interaction (5 November 2026)
• Cyber Security News: Hackers Could Bypass ChatGPT Lockdown Mode to Steal Conversations Without Users Knowing (6 November 2026)
• GBHackers: ChatGPT Lockdown Mode Bypass Allowed Hackers to Steal Private Chats Without User Interaction (6 November 2026)