Check Point Finds, OpenAI Patches ChatGPT Lockdown Mode Bypass

Cybersecurity researchers at Check Point have disclosed a now-patched flaw that let attackers slip past Lockdown Mode in OpenAI's ChatGPT, the optional setting introduced in June 2026 to curb data exfiltration from prompt injections.

According to Eli Smadja, who leads research at Check Point, the weakness stemmed from how ChatGPT renders HTML page previews inside code blocks. Those previews run in a sandbox, and Lockdown Mode limits outbound requests that could carry stolen data to attacker infrastructure. Check Point found that nested sandboxed frames allowed popups to escape those restrictions, opening a path around Lockdown Mode entirely.

Once outside the sandbox, an attacker could quietly exfiltrate chat data, phishing lures and malware through a crafted prompt, a malicious GPT or a shared chat, including zero-click theft in the desktop app. A fake ChatGPT update prompt, for instance, could coax a victim into clicking a malicious link. Smadja noted the issue wasn't confined to the Electron desktop client, and warned that AI security controls are only as strong as the surrounding application environment. OpenAI fixed the vulnerability on September 18, 2026.

Source: The Hackers News