ChatGPT Lockdown Mode Bypassed: How Entire Chats Could Leak Without a Click

The facts in 30 seconds

• What: Check Point Research bypassed ChatGPT's Lockdown Mode, the setting designed to stop data exfiltration via prompt injection.
• How: the HTML preview in code blocks could open a pop-up window that escaped the sandbox, running arbitrary code without a prompt.
• Impact: the entire chat history plus uploaded files sent to an attacker's server, spoofed update windows delivering malware, and credential theft via a forced sign-out.
• Zero-click: in the ChatGPT Classic desktop app, simply chatting with a malicious GPT was enough.
• Entry points: a malicious prompt, a malicious custom GPT or a shared chat. In the browser the victim did not even need an account.
• Fixed: OpenAI closed the hole on 18 September 2026; Check Point confirmed by retest and published on 5 November 2026.
• Exploitation: no evidence of in-the-wild attacks has been published.
• Your action: none for this bug. The lesson for enterprises goes further: a security toggle is not a security architecture.

What Lockdown Mode is supposed to do

OpenAI introduced Lockdown Mode on 13 February 2026, first for ChatGPT Enterprise, Edu, Healthcare and Teachers. Since 4 June 2026 it has also been rolling out to personal and self-serve Business accounts. OpenAI positions it as an optional, advanced setting for high-risk users such as executives and security teams, not needed by most people.

Its goal is narrow. It does not stop ChatGPT from reading manipulated content. It aims to block the last step of an attack: data leaving the chat. A typical prompt injection hides an instruction that makes the model fetch an address like attacker.example/collect?data=... with private data appended. The chat looks normal; the data ends up in the attacker's server logs.

According to OpenAI's help article, Lockdown Mode therefore disables or limits everything that can reach outward:

• Web browsing limited to cached content, no live requests.
• Images in responses and from the web are not loaded.
• Deep research and Agent mode are disabled.
• Canvas code cannot access the network.
• File downloads for data analysis are blocked.

One sentence on the same page matters for context: Lockdown Mode does not prevent prompt injections from appearing in the content ChatGPT processes. It closes exits. Check Point's finding is exactly that: an exit nobody had on the list.

How the trick worked: a window that leaves the sandbox

In February 2026 OpenAI added a preview for HTML in code blocks, so a generated web page renders right in the chat. To keep it harmless, the page runs in a sandbox of two nested iframes, small walled-off pages inside the ChatGPT interface. External images, scripts and links are intercepted, and any attempt to send data out triggers an approval prompt.

One detail did not fit. The sandbox explicitly allowed opening pop-ups (allow-popups) and letting those pop-ups escape the sandbox (allow-popups-to-escape-sandbox). Protection relied not on the sandbox but on a script that replaced window.open and only let pop-ups through after approval.

Check Point found the detour: the page simply creates one more iframe and calls that iframe's own, untouched window.open. The pop-up opens without a prompt, even in Lockdown Mode, and because it may escape the sandbox, the code inside runs unrestricted.

Put simply: the guard at the main gate was alert, but the house rules allowed windows to the outside, and nobody passed the guard on the way through the window in the side room.

Three attacks this enabled

1. Silent, zero-click exfiltration. In ChatGPT Classic, the Electron-based desktop app, window.open worked without any user gesture. A malicious custom GPT, a crafted prompt or a shared chat could send the entire conversation and uploaded files to an attacker's server. Check Point's video shows the chat continuing normally while the data leaks in the background.
2. Malware disguised as an update. The pop-up kept the ChatGPT icon while the attacker set the title, so a "ChatGPT update" with a download button looked like part of the app. In the browser it was even easier because downloads are not blocked: a shared chat link was enough, and the victim did not need a ChatGPT account. In the desktop app the user still had to click the download.
3. Stolen credentials. Check Point could also reload the main ChatGPT window and act on the user's behalf, including a forced sign-out. Anyone signing back in on a convincing fake page hands their password to the attacker.

Who was affected, and do I need to act?

The HTML preview in ChatGPT was affected in the browser and the desktop app; the fully zero-click path existed only in ChatGPT Classic. Ironically, users with Lockdown Mode switched on, the group OpenAI describes as most at risk, were not as protected as they had reason to believe.

OpenAI removed both pop-up permissions from the outer preview iframe. The fix applies on OpenAI's side, so no user action is required for this bug. Check Point retested and confirmed the technique no longer works. No exploitation has been reported. Keep the desktop app updated regardless.

Timeline

• February 2026: OpenAI adds HTML preview to code blocks.
• 13 February 2026: Lockdown Mode for Enterprise, Edu, Healthcare and Teachers.
• March 2026: Check Point shows a different hidden exit: DNS tunnelling from ChatGPT's code runtime. OpenAI fixes it.
• 4 June 2026: Lockdown Mode for personal and self-serve Business accounts.
• 18 September 2026: OpenAI informs Check Point the bypass is fixed.
• 5 November 2026: Check Point publishes the full report.

The real lesson: a toggle is not a security architecture

The bug is fixed. The pattern is what matters. The same platform had two different hidden exits within a year, first via DNS in the code runtime, then via the HTML preview. Both times a convenience feature became the escape route. Check Point's conclusion puts it plainly: every new capability expands the attack surface, including features built purely for convenience.

This is not unique to OpenAI. In recent weeks we reported on CoSnitch in Microsoft Copilot, where a crafted link could read data from connected services, and the Claude Code leak, where a convenience default put thousands of passwords on GitHub. Three vendors, three mechanisms, one common core: AI assistants are becoming full execution environments, and every feature is a potential exit.

For enterprises that means a sober assessment. Lockdown Mode is a sensible layer, but OpenAI itself offers no guarantee, and this case shows why. Anyone putting sensitive data into an external AI assistant relies on an architecture whose exits they can neither see nor audit.

What enterprises should do now

Nothing for this specific bug. Plenty for the next one, and the measures are cheap:

1. Govern shared chats and custom GPTs. No custom GPTs from unknown builders, no clicks on previews, buttons or "updates" in shared chats. Where possible, restrict custom GPTs in the workspace to vetted creators.
2. Use Lockdown Mode deliberately. Enable it as a workspace role for high-risk functions (executives, finance, legal, security), knowing it is a layer, not a guarantee.
3. Minimise apps and connectors. Enable only the connections and write actions a team actually needs, as OpenAI itself recommends.
4. Update awareness training. An unexpected sign-out or an update window inside an AI tool is a red flag. Check the address bar before typing a password.
5. Inventory and patch desktop clients. Know which AI clients run on which machines, in which version.
6. Classify data. Decide which data classes may go into external AI assistants. Health, financial, HR and customer data usually should not.
7. Document the assessment. External AI assistants belong in the GDPR Article 32 risk assessment and, for sensitive data, in a data protection impact assessment under Article 35.

GDPR: when a vulnerability becomes a breach

A closed vulnerability with no sign of exploitation is not a reportable breach. The real question is different: had a conversation with personal data actually leaked, a company would have had to assess and possibly notify within 72 hours under Article 33 GDPR, without being able to see what happened at the vendor. That dependency belongs in every evaluation of external AI tools. See our guide to GDPR-compliant AI.

When sensitive data is involved: AI on infrastructure you control

For many tasks an external assistant with clear rules is defensible. For confidential contracts, customer data, source code or regulated data the question is who controls the exits. Our private LLM service runs capable open models in our own European data centres, together with our infrastructure partner Yorizon, a joint venture of HOCHTIEF and Thomas-Krenn. Every call passes through Fugi Guardrails: prompt-injection checks, masking of personal data and logging. No US provider in the data path, no CLOUD Act exposure.

Your own infrastructure is not invulnerable either, and honesty requires saying so. The difference is visibility: you see every exit, set the guardrails yourself and can show your auditors the chain. For the wider threat model, see our guide to LLM security and the OWASP LLM Top 10.

Updates

• 11 November 2026: First published, based on Check Point's report of 5 November and OpenAI's documentation. We will update this article as new information emerges.

Frequently asked questions

What is ChatGPT Lockdown Mode?

An optional OpenAI security setting introduced on 13 February 2026 and available to personal accounts since 4 June 2026. It aims to stop data leaving the chat via prompt injection by disabling or limiting live browsing, web images, deep research, agent mode, Canvas network access and file downloads.

How was Lockdown Mode bypassed?

The HTML preview in code blocks ran in a sandbox that allowed pop-ups, and ChatGPT only guarded the window.open function. Check Point created an extra iframe and used its untouched window.open. The pop-up opened without a prompt and was allowed to escape the sandbox.

What data could leak?

According to Check Point, the entire chat history including uploaded files. Spoofed update windows for malware delivery and credential theft via a forced sign-out were also possible.

Did the attack require a click?

Not in the ChatGPT Classic desktop app, where a conversation with a malicious GPT or prompt was enough. In the browser the victim had to click the preview, but for the malware variant via a shared chat they did not need an account.

Is the vulnerability fixed?

Yes. On 18 September 2026 OpenAI removed both pop-up permissions from the outer HTML-preview iframe. Check Point confirmed by retest that the technique no longer works and published its report on 5 November 2026.

Do I need to do anything?

Not for this bug; the fix applies on OpenAI's side. Still sensible: keep the desktop app updated, avoid custom GPTs from unknown builders, do not click previews or update prompts in shared chats, and check the address bar after an unexpected sign-out.

Was the vulnerability exploited?

Neither Check Point nor OpenAI has published evidence of in-the-wild exploitation.

Does Lockdown Mode reliably prevent prompt injection?

No, and OpenAI says so itself. It does not stop prompt injections from appearing in processed content; it only aims to close exits for data. It is one layer in a security architecture, not a guarantee.

Can enterprises still use ChatGPT after this?

Yes, with clear rules: classify data, govern custom GPTs and shared chats, minimise apps and connectors, enable Lockdown Mode for high-risk roles and document the use in the GDPR Article 32 risk assessment. For highly sensitive data, AI on controlled infrastructure is advisable.

What is the alternative for sensitive enterprise data?

Capable open language models on your own or European infrastructure, protected by a guardrail layer. ADVISORI runs such models in its own European data centres with partner Yorizon and checks every call with Fugi Guardrails, with no US provider in the data path.