ChatGPT preview flaw let attackers bypass Lockdown Mode and quietly send chats out; OpenAI has fixed it

Check Point Research disclosed on November 5, 2026 a flaw in ChatGPT's HTML preview feature that let attacker-controlled content escape its sandbox, defeating Lockdown Mode, the setting meant to stop data from leaving a chat. OpenAI told the researchers on September 18, 2026 that it had deployed a fix, and users have nothing to install. Organizations that rely on Lockdown Mode should treat this as a reminder that it lowers risk but does not remove it.

What happened, in plain English

ChatGPT can show a live preview of web code it writes. If a reply contains HTML (the code behind web pages), ChatGPT can render it as a small working page inside the chat. Because that code could be hostile, the preview runs in a sandbox: a fenced-off box that should not be able to read your ChatGPT data or talk to the outside world without your approval.

Lockdown Mode is an optional, stricter setting OpenAI introduced in February 2026 for business plans and extended to personal accounts in June 2026. It switches off or limits features that connect ChatGPT to the internet, so that a prompt injection (hidden instructions planted in text the AI reads) cannot trick ChatGPT into sending your data to an attacker.

Check Point's researchers found a gap in the preview's fence. ChatGPT blocked the preview from opening new windows directly unless you approved. But the fence still allowed pop-up windows in principle, and the block only covered the obvious door. Code inside the preview could open a second, inner frame and use that frame's own, unguarded way of opening a pop-up. The pop-up then sat outside the sandbox and outside Lockdown Mode's restrictions.

Think of a building where the front door has a guard who checks everyone leaving. The guard is real, but a side door in the same lobby was never assigned a guard.

According to the researchers, an attacker could deliver this through a malicious prompt, a malicious custom GPT, or a shared chat. Possible results included quietly copying a user's entire chat history and uploaded files to an outside server, showing a convincing fake page to steal a password, or pushing a fake "ChatGPT update" that is actually malware.

Are you affected? What to do now

Most readers have nothing to patch. OpenAI told Check Point on September 18, 2026 that it had deployed a fix on its side, and Check Point says it retested and confirmed the technique no longer works.

Who was exposed before the fix:

• ChatGPT users, including those with Lockdown Mode turned on. The researchers explicitly name the ChatGPT Classic desktop app (built on Electron, a framework that packages a website as a desktop program), where they say a pop-up could open with no click at all. They say the browser version was affected too, and that the malware-delivery scenario was easier in a browser, where a shared chat was enough to trigger it. Mobile apps are not mentioned.
• The researchers do not report any exploitation in the wild, and we found no OpenAI statement on whether anyone abused it. Treat that status as unknown, not as "none."

Checklist for IT and security teams:

• No update is required for the fix itself. If you still run the ChatGPT Classic desktop app, keep it on the current version as normal hygiene.
• Watch for fake "ChatGPT update" prompts. This research showed how convincing such a lure could look. Remind users that ChatGPT updates do not arrive as download prompts inside a chat.
• Treat shared chats and custom GPTs from outside like any untrusted link. Both were named as delivery routes. This is the second ChatGPT preview-related flaw disclosed in two weeks (see our November 1, 2026 article on the share-link bug).
• Keep Lockdown Mode on if you use it. It still removes many risky features. Just do not treat it as a guarantee. Keep policies that keep credentials, customer data and secrets out of chats.
• Review chat history and retention settings for workspaces that handle sensitive data. Chat history and uploaded files were the data at risk.

OpenAI and Check Point have not published indicators of compromise (IOCs).

The expert view

Root cause. The preview used two nested iframes (frames that embed one page in another). The outer iframe's sandbox kept two permissions: allow-popups and allow-popups-to-escape-sandbox. The second one means any window opened from the frame drops the sandbox restrictions entirely. OpenAI relied on a script that overrode the frame's window.open function so that pop-ups needed user approval. That is a JavaScript-level guard layered on top of a browser-level permission. A nested frame has its own window object with its own, untouched open function, so the guard could be sidestepped. The browser's permission still said yes.

Why the defenses failed. The pattern is familiar: a security policy enforced by patching an API in one context, while the browser grants the real capability to every context the policy can't see. Browser sandbox flags are the real boundary; script overrides are a convenience. According to Check Point, the fix removed both pop-up permissions from the outer iframe, which closes the gap at the browser level rather than patching more functions.

Why Lockdown Mode didn't help. Lockdown Mode restricts ChatGPT's own network features: browsing, connectors, agent actions, canvas networking, file downloads. It assumes the rendering layer is contained. Once content escapes into an unsandboxed window, it is just a web page that can send data wherever it likes. Check Point's conclusion is that such guardrails "still offer no absolute guarantee of protection" and that securing AI assistants means considering "the platform as a whole."

Severity in context. There is no CVE or CVSS score, which is normal for a fix on a hosted service. The impact was meaningful: silent exfiltration of chat history and files, with a zero-click path in the Classic desktop app, on a product many organizations have approved for daily use. The limits: the victim still had to receive attacker content (a prompt, custom GPT or shared chat), and outside the desktop app some scenarios needed a click on a preview. Our assessment: high impact, fixed before disclosure, and not something needing end-user action. The bigger significance is for teams who chose Lockdown Mode as their answer to prompt-injection data loss.

Broader trend. AI assistants are turning into rich application platforms with previews, canvases, artifacts and plug-in renderers. Each new renderer is a new trust boundary inside a trusted origin. This is the second preview-adjacent ChatGPT issue in two weeks, after Parameter Labs' share-link chain (fixed October 26, 2026). For teams building similar features: never grant allow-popups-to-escape-sandbox to frames that render untrusted content, enforce restrictions with browser sandbox flags and Content Security Policy (CSP) rather than function overrides, and assume any API you wrap can be reached through another frame.

Still unknown. When Check Point reported the bug, the exact date OpenAI's fix went live, whether it was exploited before the fix, whether OpenAI paid a bounty, and whether OpenAI's logs could show past abuse. OpenAI has not published its own advisory that we could find.

Official sources

• Check Point Research, "ChatGPT Lockdown Mode Bypass: Phishing, Malware Delivery and Silent Data Exfiltration" (November 5, 2026)
• OpenAI, "Introducing Lockdown Mode and Elevated Risk labels in ChatGPT" (February 13, 2026, updated June 4, 2026)
• Coverage: The Hacker News, "Researchers Bypass ChatGPT Lockdown Mode to Exfiltrate Chats Without User Interaction" (November 5, 2026)