ChatGPT Lockdown Mode Bypassed via HTML Preview Popups, Check Point Finds

Check Point Research has published details of a flaw that let it get around ChatGPT’s Lockdown Mode. The bug sat in the sandbox that renders HTML previews, not in the model. Check Point says OpenAI told it a fix was deployed, and its write-up is dated 5 November 2026.

What Lockdown Mode is supposed to do

Lockdown Mode is an optional ChatGPT setting meant to cut down prompt-injection-driven data theft. According to Check Point, it limits outbound channels such as live web access and internet-hosted images, and it disables Deep Research, Agent Mode, live connectors and file downloads. The idea is simple: if the model can’t talk to the outside world, an injected prompt has nowhere to send your data.

The bypass

The weak spot was HTML page previews rendered inside ChatGPT code blocks. Those previews run in a sandbox. Check Point says ChatGPT intercepted direct attempts to open new windows, but the sandbox permissions still allowed popups and “permitted them to escape the sandbox.”

The trick was nesting. By creating another frame inside the rendered page, the researchers reached an unmodified popup function and sidestepped the restrictions on the original preview. Check Point attributes the research to Alexey Bukhteyev.

What the researchers demonstrated

Check Point describes three scenarios.

• Silent chat leakage. In ChatGPT Classic, the Electron-based desktop app, a malicious GPT leaked chat messages to an attacker-controlled server. The researchers say window.open works there without a user gesture, so a conversation alone was enough.
• Fake update and malware delivery. The popup kept the ChatGPT icon, so Check Point showed a fake ChatGPT update prompt. The victim still had to click to download the file. Check Point says this is easier in a browser, where automatic downloads are not blocked.
• Credential theft. The researchers could force a sign-out and send the user to an attacker-controlled login page.

Check Point says the attack could be delivered through a malicious prompt, a malicious GPT or a shared chat. It does not say whether the Lockdown Mode bypass was tested in both clients or only in Classic.

Disclosure and fix

Check Point says it disclosed the issue to OpenAI responsibly, but it gives no disclosure date. On 18 September 2026, Check Point says OpenAI told it that it had “deployed a fix removing the sandbox permissions that enabled the technique.” Per the technical write-up, that meant dropping the allow-popups and allow-popups-to-escape-sandbox permissions from the outer preview iframe. Check Point retested and says the technique no longer works. We found no CVE, CVSS score or bounty in either Check Point page as of 6 November 2026.

What it means for defenders

Our assessment: the finding is modest in current risk and useful as a pattern. Check Point reports it as patched, and the zero-click demo was limited to the desktop client. But it shows that a hardening mode is only as good as every component it touches, and previews, canvases and embedded frames are components too.

Check Point is a security vendor, and its blog ties the finding to its own products. Its advice, which we pass on as vendor advice, is to track which AI services employees use and where corporate data goes, set policies on what can be shared, treat applications, runtimes and connectors as part of the AI attack surface, and limit the sensitive data available to any one AI service. If your organisation relies on Lockdown Mode for high-risk users, keep it on, but don’t treat it as the only control.

References

• Check Point Blog — ChatGPT Lockdown Mode Bypass: AI Security Risks
• Check Point Research — ChatGPT Lockdown Mode Bypass: Phishing, Malware Delivery and Silent Data Exfiltration