Researchers Expose ChatGPT Lockdown Mode Vulnerability, Prompting OpenAI Security Fix
Security researchers have revealed a vulnerability that allowed attackers to bypass ChatGPT’s Lockdown Mode, potentially exposing private conversations and enabling phishing attacks through the platform’s HTML preview functionality. OpenAI reportedly resolved the issue before its public disclosure on 5 November 2026.
The vulnerability was identified by Check Point Research, which demonstrated how a weakness in ChatGPT’s code-rendering environment could circumvent security restrictions designed to prevent sensitive information from being transmitted to external servers.
According to reports from Notebookcheck and CSA Labs, OpenAI deployed a fix before the findings became public. CSA Labs reported that the company notified Check Point on 18 September 2026, after which researchers retested the technique and confirmed that the bypass was no longer effective.
The disclosure concerns a security vulnerability identified through research rather than a confirmed cyberattack. No publicly cited evidence indicates that the weakness was exploited against users or organisations.
The findings nevertheless highlight the security challenges associated with integrating interactive content-rendering features into artificial intelligence platforms, particularly those handling confidential information.
Understanding ChatGPT’s Lockdown Mode
OpenAI introduced Lockdown Mode as an optional advanced security feature designed to provide additional protection for users and organisations working with sensitive data.
The feature restricts several capabilities that could otherwise provide pathways for malicious content to communicate with external systems.
These restrictions include limiting web browsing to cached content and disabling external image retrieval, Deep Research, Agent Mode, network access through Canvas and file downloads.
The objective is to reduce the risk of data exfiltration, particularly through prompt injection attacks in which malicious instructions embedded in external content attempt to manipulate an AI assistant’s behaviour.
However, Lockdown Mode does not prevent malicious instructions from appearing in uploaded documents, shared conversations or cached web content. Instead, it is designed to restrict the mechanisms through which information could subsequently leave the protected environment.
The setting also operates independently of ChatGPT’s memory, file-upload, conversation-sharing and model-training preferences. It does not change network permissions within Codex.
According to CSA Labs, Lockdown Mode was initially introduced for ChatGPT Enterprise, Edu, Healthcare and Teachers customers on 13 February 2026, before becoming available to eligible personal and self-service Business accounts in June.
Its availability and configuration depend on the account, workspace and administrative controls involved.
How Researchers Bypassed the Security Restrictions
The vulnerability originated in ChatGPT’s HTML preview functionality, which allows users to render and interact with generated web content inside a sandboxed environment.
Sandboxing is a security mechanism intended to isolate potentially untrusted content from the main application. In this case, the preview environment used nested frames to prevent rendered HTML from directly accessing sensitive browser information, including ChatGPT cookies and local storage.
External communication was also subject to restrictions and user approval.
Check Point researchers discovered that the controls governing popup windows contained a weakness that could be exploited to escape the intended isolation.
Although ChatGPT intercepted direct attempts to open new windows, the underlying sandbox permissions still allowed popups and permitted those windows to operate outside the original sandbox.
By creating an additional nested frame, researchers were able to access popup functionality that had not been modified by ChatGPT’s interception mechanism.
This allowed content to open in a new window without remaining subject to the original sandbox restrictions.
According to the research, the technique provided a way to bypass Lockdown Mode’s intended protections and potentially transmit conversation data to an attacker-controlled server.
Importantly, the issue concerned the interaction between the application interface and its rendering environment, rather than a vulnerability in the underlying AI model.
Potential Exposure of Private Conversations
Check Point demonstrated several attack scenarios that could exploit the vulnerability.
The researchers identified malicious prompts, custom GPTs and shared conversations as potential entry points for delivering content capable of triggering the bypass.
One demonstrated capability involved transmitting chat content to an external server controlled by an attacker. Notebookcheck described the potential exposure as extending to an entire conversation history.
The researchers also demonstrated how an attacker could manipulate the appearance of a popup window while retaining the ChatGPT application icon.
This could enable convincing impersonation attempts, including fraudulent software-update notifications encouraging users to download malware.
Another scenario involved redirecting users to an attacker-controlled authentication page after an apparent sign-out, creating an opportunity to steal login credentials.
These examples demonstrated possible exploitation techniques, not confirmed incidents involving real victims.
The extent to which user interaction was required also remains unclear across the publicly available reports.
Notebookcheck indicated that browser-based exploitation required a user to click an HTML preview, while the Electron-based ChatGPT Classic desktop application reportedly permitted certain windows to open without direct interaction.
CSA Labs noted that Check Point’s summary also described data exfiltration without user interaction regardless of the access method.
Those differing accounts have not been fully reconciled in the public documentation, making it difficult to establish whether all affected environments were susceptible to the same attack conditions.
OpenAI Fixes Vulnerability Before Public Disclosure
The reported remediation timeline indicates that OpenAI addressed the weakness several weeks before the research findings were published.
CSA Labs stated that OpenAI informed Check Point on 18 September 2026 that a fix had been deployed. Subsequent testing reportedly confirmed that the original bypass technique no longer worked.
The remediation involved removing the problematic sandbox permissions that allowed popup windows to escape the restricted environment.
Check Point publicly disclosed its findings on 5 November, with CSA Labs publishing a further analysis on 6 November.
The available reporting does not identify a Common Vulnerabilities and Exposures (CVE) reference, a formal severity score or specific affected software versions.
There is also some uncertainty surrounding the full scope of the remediation.
Notebookcheck reported that users did not need to take additional action because OpenAI had addressed the vulnerability through its infrastructure.
CSA Labs, however, noted that public information had not established whether the fix also required an update to the ChatGPT desktop application.
That distinction is particularly relevant to organisations managing desktop installations, where locally installed software components may require separate updates.
Without confirmed version information, administrators cannot determine from the public reporting alone whether every affected client was remediated exclusively through server-side changes.
A Second Vulnerability in the Same Component
The disclosure followed another security finding involving ChatGPT’s HTML preview functionality.
Approximately one week earlier, Parameter Labs revealed a separate vulnerability chain that could potentially enable account takeover following a single user interaction.
Although both findings involved the HTML preview component, Check Point told The Hacker News that they were distinct vulnerabilities.
The distinction is important because the techniques, exploitation requirements and potential consequences should not be treated as interchangeable.
Nevertheless, the disclosures illustrate how supplementary application features can introduce security risks even when the underlying AI model and its primary operating environment are subject to extensive protections.
Interactive previews, embedded content and browser-like functionality can expand an application’s attack surface, creating opportunities for malicious content to interact with components beyond the intended security boundary.
Implications for Users and Organisations
Despite the reported bypass, security researchers have not recommended abandoning Lockdown Mode.
Instead, the findings reinforce the importance of treating application-level protections as one component of a broader cybersecurity strategy.
CSA Labs recommends that organisations handling confidential information continue using Lockdown Mode where appropriate, while supplementing it with additional security controls.
These can include network-level restrictions on outbound connections, data loss prevention systems and policies governing access to interactive content-rendering features.
Organisations should also identify whether employees access ChatGPT through browsers, desktop applications or both, and ensure that managed installations receive relevant security updates.
For particularly sensitive environments, restricting or disabling HTML previews and similar interactive features may provide additional protection where administrative controls permit.
Individual users should remain cautious when interacting with unfamiliar custom GPTs, shared conversations and content that requests unusual actions, particularly software downloads or authentication through unexpected websites.
Lockdown Mode reduces certain risks associated with prompt injection, but it does not eliminate the possibility of encountering malicious instructions.
Users should also recognise that the feature does not independently alter privacy preferences governing conversation sharing, memory or the use of data for model improvement.
A Broader Lesson in AI Application Security
The Check Point findings demonstrate how security controls designed to restrict data movement can be undermined by functionality operating outside their intended boundaries.
Although Lockdown Mode limits several established routes for external communication, the HTML preview vulnerability introduced an alternative pathway that researchers were able to exploit.
The reported fix and successful retesting indicate that the demonstrated technique was addressed before public disclosure. However, the lack of detailed version information leaves some uncertainty about remediation across different application environments.
For organisations incorporating AI systems into sensitive workflows, the case underscores the importance of examining the security of the complete application rather than relying exclusively on protections associated with the AI model.
As platforms such as ChatGPT continue to integrate increasingly interactive tools, rendering engines and external services, those components will remain important considerations in security assessments.
The vulnerability does not establish that Lockdown Mode is ineffective, nor does the public record demonstrate that attackers exploited it against users.
It does, however, illustrate a broader challenge for AI security: protective controls must account not only for what an assistant can generate, but also for how the surrounding application processes, displays and communicates that content.
With the reported bypass resolved, the outstanding question concerns the completeness of remediation across supported clients, particularly desktop installations.
Until that scope is publicly clarified, organisations should verify their application versions and maintain additional safeguards rather than assuming that any single security setting provides comprehensive protection.
A security toggle can only govern what it was built to see. The bypass described here took its route through a rendering feature outside the model, where sandbox permissions and popups decided what content could reach, which makes the boundary between web content and its host worth understanding properly. Internet vulnerabilities covers how weaknesses in web software are classified, described and disclosed, giving readers a clearer sense of where one component’s scope ends and another’s begins. Readers who want that grounding can explore The Hack Academy’s online cybersecurity training programme where internet vulnerabilities is one of the listed subject areas, with self-paced learning and practical exercises alongside the theory, all studied in authorised, controlled environments. It will not settle whether every desktop client was covered, but it makes the next question about scope far easier to frame.