Check Point Research, the research unit of security company Check Point, published a report on 5 November 2026 describing how ChatGPT’s Lockdown Mode protections could be bypassed through another feature. In the report, researcher Alexey Bukhteyev wrote that OpenAI told Check Point on 18 September that it had fixed the flaw. Check Point retested the technique and found that it no longer works.

Lockdown Mode is an optional setting for signed-in users. It is designed to reduce the risk that a prompt injection causes ChatGPT or one of its tools to send sensitive data out. In a prompt injection, the model receives content whose instructions it follows instead of the user’s. The mode therefore cuts off outbound routes. Web search is limited to cached content, and images from the internet are not loaded. Deep Research, Agent Mode, connectors to external services and file downloads are disabled. OpenAI introduced the mode in June 2026, The Hacker News reported.

How the protection was bypassed

In February 2026, OpenAI gave code blocks a preview that displays an HTML page directly in ChatGPT. ChatGPT runs the page in a sandbox inside two nested iframes. An iframe is a separate view embedded in a page. This stops the previewed page from accessing ChatGPT’s cookies or other data. When the page tries to contact an external address or open a pop-up window, ChatGPT first asks the user for permission.

Check Point said the permission prompt relied on ChatGPT having replaced the page’s window.open function with its own version. However, the frames’ sandbox settings allowed pop-ups and let them escape the sandbox. By creating one more frame inside itself, the page gained access to the original function. In the window that opened, the attacker’s code ran without the sandbox restrictions.

What an attacker could do

The attack could be triggered by a malicious prompt, a malicious GPT or a shared conversation. Check Point said the route could be used to leak the entire conversation history and files uploaded to ChatGPT, display phishing windows and spread malware, for example as a fake update. The window showed the ChatGPT icon and a title chosen by the attacker.

In the browser, the victim had to click the preview, but after that a file could download automatically. With a shared conversation, the victim did not even need a ChatGPT account. In the Electron-based ChatGPT Classic application, the window opened without a click, Check Point said, so a conversation alone was enough for the leak. In the application, the attacker could also log users out and lure them into signing in on the attacker’s page.

In the fix, OpenAI removed from the outer preview frame the settings that allowed pop-ups. The account of the fix rests on OpenAI’s notification and Check Point’s retest; The Hacker News repeats it.

Eli Smadja, head of research at Check Point, said in the report shared with The Hacker News: ‘AI security controls are only as strong as the wider application environment around them.’

Parameter Labs described another flaw involving HTML preview a week earlier, The Hacker News reported. Through it, opening a public share link could give an attacker access to the victim’s signed-in session.