Check Point Research found a way around Lockdown Mode, the optional ChatGPT setting built to stop prompt-injection attacks from shipping private data to an attacker. In the Electron-based desktop app, the technique worked with zero clicks from the victim: a crafted prompt, a malicious custom GPT or a shared chat could open a hidden window and send chat contents to an outside server. OpenAI closed the hole on Sept. 18, and Check Point published its write-up on Nov. 5 after retesting.
Tech news in one quick read: Get the most interesting stories in startups, tech and programming, each with a short TLDR, in one daily email from TLDR.
We may earn a commission if you sign up.
The flaw never touched the model or the policy logic behind Lockdown Mode. It lived in a feature OpenAI added to ChatGPT code blocks in February 2026, an HTML preview that renders pages inside a sandbox, and in the permissions that sandbox was given. The protection therefore held at the level of the model and failed at the level of the web page wrapped around it, which matters to anyone who turned the setting on believing it sealed off every outbound path.
How a nested frame turned a blocked popup into an escape
The preview runs inside two nested iframes. According to Check Point’s technical write-up, the outer frame still carried the sandbox flags that allow popups and let them escape the sandbox. ChatGPT tried to compensate by redefining the browser function window.open so that any popup needed user approval, and calls with an empty address or about:blank silently returned nothing.
The redefinition covered only the top-level page. An attacker could create a fresh iframe inside the preview and call open on that frame’s own window object, which produced a real popup. Because the outer frame allowed popups to escape, the new window ran arbitrary HTML outside every sandbox restriction, and Lockdown Mode, which governs what the app itself will fetch or send, had nothing to say about it.
Check Point researcher Alexey Bukhteyev wrote the report, and Eli Smadja, the firm’s head of research, told The Hacker News the underlying issue could enable silent chat data theft, phishing and malware delivery. The Hacker News coverage quotes him saying the sandbox permissions still allowed popups and permitted them to escape the sandbox.
Zero-click behavior in the Electron desktop client
A browser normally demands a user gesture before opening a window. Check Point reports that in the ChatGPT Classic desktop client, built on Electron, window.open worked with no gesture at all, which is what turned a clever trick into silent exfiltration. Beyond stealing chat data, the same primitive let an attacker reload the main window, force a sign-out and stage a credential-phishing page in its place. Check Point also noted that the underlying weakness is not limited to the Electron app. In a browser, the route led to malware delivery through shared chats, and the victim did not need an account.
The attack also had several ways in. A direct prompt would do, as would a custom GPT built for the purpose, or a shared conversation opened by an ordinary user. Check Point described a fake ChatGPT update prompt as one social-engineering outcome, with the popup posing as the app asking for a download.
What Lockdown Mode promised and what OpenAI changed
OpenAI began rolling out Lockdown Mode in June 2026 to personal Free, Go, Plus and Pro accounts and self-serve Business accounts, Help Net Security reported. With it on, live web browsing falls back to cached content, file downloads for analysis are blocked, Deep Research and Agent Mode are switched off, live connectors are disabled and Canvas code cannot make network requests. Memory, file uploads and conversation sharing keep working, so a shared chat remained a plausible delivery route even with the setting on.
OpenAI told Check Point on Sept. 18 that it had removed the two popup permissions, allow-popups and allow-popups-to-escape-sandbox, from the outer preview frame. Check Point retested and concluded the technique described no longer works. TechRadar’s account adds that the fix was applied on OpenAI’s side and that Check Point drew a broader lesson: AI security controls are only as strong as the wider application environment around them.
A second preview-component bug from a different team
A week before Check Point published, Parameter Labs researcher Mukul Goyal described a separate account-takeover bug in the same HTML preview component. Simon Willison’s summary of that disclosure says a crafted share link chained a virtual-keyboard library that wrote messages into the page, a content security policy that permitted YouTube scripts, and a reflected JavaScript endpoint, letting attacker code run in a signed-in victim’s session. OpenAI fixed it and paid a $5,000 bug bounty.
A Cloud Security Alliance research note on the bypass treats both findings as one story about rendering features becoming a concentrated attack surface. It advises organizations to confirm managed desktop clients are on current builds, keep Lockdown Mode on for staff handling sensitive data while treating it as one layer, and consider disabling HTML previews for the highest-risk users. Check Point has not said how many people the desktop-app route could have reached before September, and OpenAI has not published its own account.
This article was produced with the assistance of AI and reviewed by Morning Overview editors prior to publication.
Tech news in one quick read: Subscribe to TLDR →
We may earn a commission if you sign up.
More from Morning Overview
- Lake Powell sank to a record 3,517 feet, nearing the level that stops Glen Canyon Dam’s turbines
- Seven of Earth’s nine planetary boundaries are breached, and all seven are worsening
- The NSA says three phone features should be off whenever you aren’t using them
- Hurricane Hunter radar shows four warning signs that a tropical cyclone is about to strengthen, a University of Miami study found
