Researchers Bypass ChatGPT Lockdown Mode, Exposing Critical AI Security Vulnerability

Check Point Research Discovers Critical ChatGPT Lockdown Mode Vulnerability

Cybersecurity researchers at Check Point Research have exposed a significant vulnerability that allowed attackers to bypass ChatGPT Lockdown Mode, a security feature specifically designed to prevent data exfiltration through prompt injection attacks1

1

. Eli Smadja, head of research at Check Point, revealed that the flaw could enable silent chat data theft, phishing and malware delivery, including zero-click data exfiltration in the ChatGPT desktop application2

2

. OpenAI introduced Lockdown Mode in June 2026 as an optional advanced security setting to minimize risks from malicious instructions hidden within content processed by the AI system2

2

.

How the Bypass Exploited HTML Page Previews and Sandbox Restrictions

The vulnerability stemmed from HTML page previews inside ChatGPT code blocks, which allow HTML content to be rendered directly within the application1

1

. While ChatGPT places this content inside a sandbox to prevent access to cookies, local storage, and external resources without user consent, Check Point Research discovered a critical loophole in how popup windows were handled. The HTML preview used nested sandboxed frames, and although ChatGPT intercepted direct attempts to open new windows, the underlying sandbox permissions still allowed popups to escape the sandbox2

2

. By creating another nested frame within the rendered page, researchers accessed an unmodified popup function and bypassed the restrictions placed on the original HTML preview1

1

. Content opened through this route was no longer subject to the same sandbox restrictions, providing a way to circumvent Lockdown Mode protections entirely.

Attack Scenarios Range from Data Exfiltration to Credential Theft

Once the restrictions were bypassed, threat actors could exploit the vulnerability through multiple attack vectors. An attacker could exfiltrate data and chat messages or deliver malicious payloads by means of a crafted prompt, a malicious GPT, or a shared chat1

1

. Because an attacker gained complete control of the content displayed in the popup window, it could render convincing social-engineering lures, such as a fake ChatGPT update, and trick victims into downloading malware by persuading them to click on a link1

1

. Check Point Research confirmed that the most significant risk demonstrated is the potential for data exfiltration without user interaction, regardless of how ChatGPT is accessed2

2

. While researchers used the desktop application in their demonstration, the underlying technique is not limited to the desktop environment, highlighting broader AI security concerns.

OpenAI Patches Flaw Following Responsible Disclosure

Following responsible disclosure by Check Point Research, OpenAI addressed the vulnerability on September 18, 20261

1

. Check Point Research confirmed that the technique described in their research no longer works after the patch was implemented2

2

. However, the discovery comes just a week after Parameter Labs detailed another method to bypass ChatGPT's sandbox and content security policy, enabling account takeover simply by sending an attacker-controlled public ChatGPT share link1

1

. Security researcher Mukul Goyal from Parameter Labs explained that an attacker could create a malicious conversation, publish it using ChatGPT's normal sharing feature, and send the link to another user, with the payload executing as chatgpt.com with access to the victim's authenticated web session1

1

.

Broader Implications for Enterprise AI Security Controls

The vulnerability originated in the wider application environment, demonstrating how weaknesses outside the AI model itself can undermine dedicated AI security controls2

2

. Smadja emphasized that Lockdown Mode was specifically intended to reduce the possibility of data leaving a conversation through potentially malicious outbound requests, yet a weakness in another application feature provided an alternative path around that security boundary1

1

. The finding raises a critical enterprise security issue: AI security controls are only as strong as the wider application environment around them2

2

. Earlier in September, Check Point also demonstrated a covert cross-account command channel through which an attacker could use a victim's ChatGPT session to run hidden tasks with the tools, data, and connected apps available to that session, alongside the visible conversation1

1

. These discoveries coincide with numerous security shortcomings in various AI-driven tools and services over recent months, revealing persistent challenges in securing AI systems against prompt injection and other sophisticated attack vectors that exploit vulnerabilities beyond the core AI model.