OpenAI Fixes ChatGPT Lockdown Mode Bypass

Check Point Research found a vulnerability that bypassed ChatGPT's Lockdown Mode protections, according to the firm's security research. The flaw could allow attackers to extract chat history and uploaded files, display phishing pages, or distribute malware.

The vulnerability affected the HTML page preview feature in ChatGPT code blocks. Attackers could use a nested iframe to open a new window outside the HTML sandbox, bypassing controls on external requests and arbitrary URLs. Attacks could be delivered through a malicious prompt, a custom GPT, or a shared chat.

In the Electron-based ChatGPT Classic application, a malicious GPT could extract chat data without a click or other user action. Browser attacks could use a deceptive preview to prompt users to download malware or enter credentials on an attacker-controlled page.

OpenAI deployed a fix on September 18, 2026. The company removed permissions that allowed popups to open and escape the outer HTML preview sandbox, and Check Point confirmed that the reported technique no longer worked.