Check Point finds ChatGPT Lockdown Mode bypass enabling data theft

Check Point Research has disclosed a vulnerability in OpenAI’s ChatGPT that bypassed the platform’s Lockdown Mode, the optional security setting designed to limit prompt-injection based data exfiltration. The flaw, described by the researchers as broad in its impact, could enable covert exfiltration of entire chat histories, credential theft via phishing, and malware delivery, with the most severe form allowing zero-click data leakage in ChatGPT Classic simply by engaging in a conversation. The findings, published on 5 November 2026, are attributed to Alexey Bukhteyev of Check Point Research.

Technical details from the disclosure show that OpenAI added an HTML page preview feature within ChatGPT code blocks in February 2026, which includes multiple safeguards but also introduced a route for bypassing the Lockdown Mode protections.

The vulnerability stems from the way the HTML preview sandbox and its iframe permissions (notably allow-popups and allow-popups-to-escape-sandbox) could be manipulated to open a real window or nested iframe content, enabling a rogue page to prompt malware downloads, phishing lures, or data exfiltration to attacker-controlled servers. Check Point describes several exploit scenarios, including spoofed application windows delivering malware updates and a shared chat containing malicious content.

OpenAI said it removed the problematic permissions from the outer HTML-preview sandbox iframe on 18 September 2026, after which Check Point reportedly retested and confirmed the exploitation technique no longer worked.