OpenAI Patches ChatGPT Lockdown Mode Bypass in HTML Previews

OpenAI has patched a vulnerability in ChatGPT that allowed attackers to bypass Lockdown Mode through HTML page previews in code blocks. Check Point said the issue could enable silent chat-data theft, phishing and malware delivery, including zero-click data exfiltration in the ChatGPT desktop application. OpenAI addressed the flaw on September 18, 2026, following responsible disclosure.

Lockdown Mode, introduced in June 2026, is an optional ChatGPT setting designed to reduce data-exfiltration risks from prompt injection. It limits outbound network requests that could otherwise transfer sensitive information to attacker-controlled infrastructure. The finding showed that a weakness in a separate application feature could provide a route around that boundary.

Nested frames opened a route beyond the preview sandbox

ChatGPT can render HTML content directly inside the application through page previews embedded in code blocks. Because user-supplied HTML and JavaScript present security risks, the preview content is placed in a sandbox. That sandbox is intended to block access to app data such as cookies and local storage, and to prevent external communications without user consent.

Check Point identified a loophole in popup handling. The HTML preview used nested sandboxed frames; while ChatGPT intercepted direct attempts to open new windows, the sandbox permissions still allowed popups to escape the sandbox. By creating another nested frame in the rendered page, researchers could access an unmodified popup function rather than the restricted function available to the original preview.

Content opened through that path was no longer subject to the same sandbox restrictions. Check Point said an attacker could use a crafted prompt, a malicious GPT or a shared chat to exfiltrate chat messages or deliver malicious payloads. A popup under attacker control could also display a persuasive social-engineering lure, including a fake ChatGPT update intended to persuade a victim to download malware.

AI security controls depend on the surrounding application

The issue was not limited to the Electron-based desktop environment, underscoring that AI security controls can be undermined by application features outside the model itself. Check Point characterized the case as a broader enterprise concern: a control that restricts malicious outbound requests is insufficient if another feature offers an alternative route for data to leave a conversation.

The disclosure follows other reported ChatGPT security findings. Parameter Labs described a separate method involving a public shared chat link and an HTML preview that could execute under chatgpt.com with access to an authenticated web session. Check Point also described a covert cross-account command channel involving code-execution environments in different ChatGPT accounts.

For businesses, the practical implication is to assess AI deployments as complete applications: shared conversations, custom GPTs, HTML rendering, popup behavior and connected tools all require review alongside model-level prompt-injection protections. Security teams should apply available patches promptly and account for untrusted content paths when defining how employees use AI services.