ChatGPT Lockdown Mode bypass exposed a wider AI security risk

A bypass around ChatGPT’s security controls

Lockdown Mode is an optional advanced security setting designed to reduce the risk of sensitive information leaving ChatGPT through prompt injection. It restricts potential outbound channels, including live web access and internet-hosted images, while disabling Deep Research, Agent Mode, live connectors and file downloads.

Check Point Research found that HTML page previews inside ChatGPT code blocks provided another route around these protections. The feature renders HTML content within ChatGPT, using a sandbox intended to separate the content from the main application and limit access to cookies, local storage, the application interface and external resources.

According to Check Point Research, a weakness in the handling of popup windows allowed a popup to escape the sandbox. By creating another nested frame within the rendered page, researchers accessed an unmodified popup function and bypassed restrictions applied to the original HTML preview.

Potential attacks included data theft and phishing

The researchers said the vulnerability could support several attack scenarios, including chat data exfiltration, credential phishing and malware delivery. The attack could potentially begin with a malicious prompt, malicious GPT or shared chat.

In the ChatGPT desktop application, a new window retained the ChatGPT application icon while its title and content could be controlled by an attacker. Check Point Research demonstrated how this could be used to present a fake ChatGPT update and encourage a victim to download malware. Researchers also found that the main application window could be manipulated in ways including forcibly signing a user out, creating a possible route to an attacker-controlled authentication page.

The most serious scenario involved the Electron-based desktop application. The popup behavior worked without a user gesture, allowing researchers to demonstrate a malicious GPT silently leaking chat messages to an attacker-controlled server while a victim was having a conversation. The desktop download scenario still required the victim to click a link, according to the research.

Why the finding matters for enterprise AI security

Check Point Research said the technique was not limited to the desktop environment, even though the demonstration used that application. The vulnerability originated in the wider application environment rather than the AI model itself, showing how weaknesses in runtimes, sandboxes, code-execution environments or connectors can undermine controls designed to protect an AI system.

For organizations, the risk is greater when employees use AI assistants with confidential business information, uploaded documents or other sensitive context. Check Point recommends gaining visibility into AI usage, controlling what information employees share with AI services, assessing the components around the model and limiting the sensitive information available to third-party platforms.

Check Point Research responsibly disclosed the vulnerability to OpenAI. The company informed researchers on September 18, 2026, that it had deployed a fix removing the sandbox permissions that enabled the technique. Check Point subsequently retested the issue and confirmed that the described exploitation method no longer works. The result leaves enterprises with a broader lesson: protecting AI data requires controls around the full application environment, not only the model or a single security setting.