Check Point Research says a flaw let attackers bypass ChatGPT’s Lockdown Mode protections to steal chat data, deliver malware or phish for credentials. OpenAI told the researchers it deployed a fix on 18 September, and they say their retest confirmed the described exploit no longer worked.
OpenAI Watch analysis
What happened
The researchers traced the bypass to ChatGPT’s HTML page preview. They say a nested iframe could open a pop-up that escaped the preview’s sandbox, creating a route around safeguards intended to limit external requests and protect sensitive information.
Check Point says attacks could be delivered through a malicious prompt, GPT or shared chat. In ChatGPT Classic, it reports that simply having a conversation could trigger silent data exfiltration, without the user needing to click anything. Other scenarios involved phishing or malware lures, with some requiring a click.
The researchers say OpenAI fixed the issue by removing two permissions from the outer HTML-preview sandbox iframe. They disclosed the flaw to OpenAI and report that their subsequent test no longer reproduced the exploit.
Why it matters
Lockdown Mode is designed to reduce the risk of prompt injection causing data to leave a conversation. A bypass in the feature’s surrounding interface could undermine that protection, even when the model itself is not the weak point. The reported Classic-app behaviour is particularly serious because it did not require a user interaction.
The practical takeaway is that security features can depend on the software around them as much as on the headline setting. Check Point says this particular exploit was fixed, so its report is not evidence that the described attack still works. It is, however, a useful reminder not to treat a protective mode as a guarantee that sensitive data is untouchable.
Our read
The good news is that the researchers say OpenAI fixed the flaw and that their retest confirmed the bypass no longer worked. The less comforting lesson is how an ordinary-looking preview feature could become a route to data theft. Convenience features deserve careful security boundaries, especially when they sit inside an assistant handling private conversations.
What to watch
- Whether OpenAI publishes more detail about the fix and the affected versions or clients.
- Whether Check Point or OpenAI reports evidence that the flaw was exploited in the wild.
- Whether future HTML preview features retain similarly permissive pop-up behaviour.
Discussion spark: When an AI service offers a security mode, should users be able to rely on it for sensitive conversations, or should providers make its limits and remaining risks much more visible?
Sources and evidence
- ChatGPT Lockdown Mode Bypass: Phishing, Malware Delivery, and Silent Data Exfiltration – Check Point Research (5 November 2026, 14:00 UTC)
OpenAI Watch is independently operated by WittyWires. It is not affiliated with, endorsed by, or operated by OpenAI.