ChatGPT Lockdown Mode Vulnerability Allowed Attackers to Steal Private Chats Without User Interaction

A security vulnerability discovered by Check Point Research exposed a weakness in ChatGPT’s optional Lockdown Mode, potentially allowing attackers to extract private conversations, steal login credentials and deliver malware through the platform’s trusted interface. The vulnerability involved the way ChatGPT handled HTML previews inside code blocks, allowing malicious content to bypass restrictions designed to prevent sensitive information from leaving conversations.

The research, published on November 5, 2026, demonstrated that attackers could exploit the weakness through malicious prompts, custom GPTs or shared conversations. In the most serious scenario involving the ChatGPT desktop application, researchers demonstrated that conversation data could be transmitted to an attacker-controlled server without requiring the user to click anything. OpenAI addressed the vulnerability after responsible disclosure, and Check Point confirmed that the original exploitation technique no longer worked.

What Was the ChatGPT Lockdown Mode Vulnerability?

Lockdown Mode is an optional security feature introduced by OpenAI for users who require stronger protection against advanced cyberattacks.

It is designed to reduce the risk of prompt injection, an attack technique in which malicious instructions are hidden inside content processed by an AI system. These instructions can attempt to manipulate the assistant into exposing sensitive information or interacting with external services.

Lockdown Mode limits several capabilities that could potentially be abused to transfer private information outside ChatGPT.

These restrictions include:

• Limiting web browsing to cached content.
• Disabling external image support.
• Turning off Agent Mode and Deep Research.
• Restricting live connectors and Canvas networking.
• Disabling file downloads.

The objective is to reduce the number of channels through which an attacker could extract sensitive information.

However, Check Point Research discovered that a separate feature inside ChatGPT’s HTML preview environment created another potential route around these protections.

How Hackers Bypassed ChatGPT’s Security Restrictions

The vulnerability involved HTML previews that allow users to render web content directly inside ChatGPT.

When users work with HTML code blocks, ChatGPT can display the generated content as a preview. Because HTML can execute JavaScript, this functionality requires security restrictions to prevent malicious code from accessing sensitive application information.

OpenAI used two nested sandboxed iframes to isolate the rendered content from the main ChatGPT application.

These sandbox restrictions were intended to control external requests, prevent unauthorised access and require approval before opening external destinations.

However, researchers found a weakness in how popup windows were handled.

The outer sandbox allowed certain popup permissions, including the ability for popups to escape the sandbox. ChatGPT attempted to compensate by overriding the JavaScript window.open function so that external windows required user approval.

Check Point researchers discovered that this protection could be bypassed by creating another nested iframe and accessing its underlying popup function.

The resulting popup could escape the original sandbox restrictions and execute attacker-controlled HTML outside the protected preview environment.

This created a route through which malicious content could bypass the restrictions intended to protect ChatGPT conversations.

Private Chat Histories Could Be Exfiltrated Silently

The most serious demonstration involved the potential theft of private conversation data.

Researchers showed that malicious content could use the vulnerability to send ChatGPT messages to an external server controlled by an attacker.

In the ChatGPT desktop application, the popup could open without requiring a user gesture. This meant that a victim did not necessarily need to click a suspicious link or approve an external connection for the demonstrated data-exfiltration scenario to work.

The attack could potentially originate from:

• A malicious prompt containing hidden instructions.
• A malicious custom GPT.
• A shared conversation containing attacker-controlled content.

The vulnerability was particularly concerning because Lockdown Mode was specifically designed to prevent sensitive information from being transmitted through malicious external requests.

The research demonstrated that a weakness in an application feature outside the model’s core reasoning system could undermine those protections.

Attackers Could Also Deliver Malware and Steal Credentials

The research identified additional attack scenarios beyond private chat extraction.

One involved creating a convincing fake ChatGPT popup window.

Because the popup retained the ChatGPT application icon while allowing attackers to control its title and content, malicious actors could potentially make a fraudulent window appear to be part of the genuine application.

Researchers demonstrated how this could be used to display a fake ChatGPT software update and encourage users to download malware.

The researchers also found that attackers could manipulate the main application window and force users to sign out. A victim could then be presented with a fraudulent login page designed to capture account credentials.

These scenarios demonstrate how vulnerabilities in trusted interfaces can make phishing attacks more convincing.

However, the malware delivery demonstration required the victim to click a download link. The zero-click chat-exfiltration scenario was a separate and more serious finding.

How OpenAI Responded to the Security Flaw

Check Point Research responsibly disclosed the vulnerability to OpenAI.

According to the researchers, OpenAI informed them on September 18, 2026, that it had removed the problematic allow-popups and allow-popups-to-escape-sandbox permissions from the outer HTML-preview iframe.

These changes addressed the underlying weakness that allowed malicious content to open unrestricted popup windows.

Check Point subsequently retested the vulnerability and confirmed that the original exploitation technique no longer worked.

The timeline is important: the security issue had been addressed before the research was publicly reported in November 2026.

The findings therefore describe a patched vulnerability, not an attack method that researchers confirmed was still working after the fix.

Why This Vulnerability Matters for AI Security

The incident highlights an important challenge facing companies developing AI assistants.

Modern AI platforms are no longer limited to generating text. They can execute code, process files, render web content, connect to external applications and interact with other software systems.

Every additional capability creates another component that security teams must protect.

A model can have strong safeguards against malicious instructions, but weaknesses in the surrounding application environment may still create opportunities for attackers.

The ChatGPT incident illustrates several broader security concerns:

Application sandboxing: Features that render HTML or execute code must be isolated carefully to prevent malicious content from accessing external resources.

Prompt injection: AI systems may encounter malicious instructions inside documents, shared chats and other content.

Data protection: Sensitive information should remain protected even if an individual application feature contains a vulnerability.

Third-party integrations: Connectors, tools and external services increase the number of potential security boundaries.

For businesses, these risks are particularly important because employees increasingly use AI assistants to process internal documents, customer information and confidential business discussions.

What ChatGPT Users Should Do

OpenAI addressed the specific vulnerability, and Check Point confirmed that the demonstrated exploit no longer worked.

Nevertheless, users should continue following basic security practices when interacting with AI platforms.

• Avoid opening suspicious links or files shared through conversations.
• Be careful when using custom GPTs from unfamiliar sources.
• Avoid sharing passwords, authentication codes or unnecessary confidential information.
• Keep ChatGPT applications and browsers updated.
• Treat unexpected login requests and software-update prompts with caution.

Organisations should also establish policies governing what employees can share with AI systems and monitor how connected applications handle sensitive information.

Lockdown Mode provides additional protection for users with higher security requirements, but no single security setting should be treated as a guarantee against every possible attack.

The Bigger Picture

The ChatGPT vulnerability demonstrates that AI security extends beyond the underlying language model. Even when an AI system has restrictions against revealing private information, weaknesses in features such as HTML previews, browser interfaces and application integrations can create alternative attack paths.

As AI assistants become more capable, developers will need to secure the entire environment surrounding the model. This includes sandboxing, tool permissions, data access controls, external connections and monitoring.

For the broader technology industry, the incident is a reminder that AI convenience features must be designed alongside security protections rather than treated as separate components.

Looking Ahead

OpenAI’s response shows the importance of responsible vulnerability disclosure and rapid security fixes. However, the incident is likely to encourage further research into how AI applications isolate user-controlled content and protect private conversations from malicious external instructions.

As companies increasingly use AI assistants for sensitive business operations, security testing will need to cover not only model behaviour but also the interfaces, tools and execution environments surrounding AI systems. The next generation of AI security will depend on protecting the complete application ecosystem rather than relying exclusively on model-level safeguards.