Overview
Cybersecurity researchers at Check Point disclosed a now-patched vulnerability in OpenAI’s ChatGPT that allowed attackers to silently bypass Lockdown Mode — a security feature introduced in June 2026 specifically to mitigate data exfiltration risks from prompt injection attacks. The flaw enabled zero-click exfiltration of chat messages, phishing lure delivery, and malware distribution without requiring any victim interaction beyond opening a malicious conversation.
OpenAI addressed the vulnerability on September 18, 2026, following responsible disclosure.
Technical Analysis
ChatGPT supports HTML rendering within code blocks via a sandboxed preview mechanism. The sandbox is designed to prevent rendered content from accessing application data (such as cookies or local storage) or making outbound network requests — restrictions reinforced further by Lockdown Mode.
Check Point’s Eli Smadja identified a logic flaw in how popup windows are handled during HTML preview rendering. The HTML preview used nested sandboxed `` elements, and while ChatGPT intercepted direct attempts to open new windows at the top-level frame, the underlying sandbox allow-popups permission persisted in nested frames.
By creating an additional nested frame within the rendered HTML page, researchers were able to access an unmodified window.open() function — bypassing the restrictions applied to the outer preview frame. Content opened via this route was no longer subject to the sandbox constraints or Lockdown Mode’s outbound request blocking.
Once outside the sandbox boundary, an attacker gains full control over the popup window’s rendered content and network access, enabling:
- Zero-click chat data exfiltration — conversation history sent to attacker-controlled infrastructure
- Phishing lure rendering — convincing fake ChatGPT update pages presented to users
- Malware delivery — users socially engineered into downloading malicious payloads
Attack delivery vectors include crafted prompts, malicious custom GPTs, or shared chat links — all of which could carry the exploit payload.
Notably, the underlying weakness exists in the Electron-based desktop application’s rendering layer, not in the AI model itself, underscoring how application-layer flaws can undermine AI-specific security controls.
Framework Mapping
- AML.T0077 (LLM Response Rendering) — the attack exploits the HTML rendering pipeline as the primary attack surface
- AML.T0051 (LLM Prompt Injection) — crafted prompts serve as one delivery vector for the malicious HTML payload
- AML.T0057 (LLM Data Leakage) — chat message exfiltration is the primary impact
- AML.T0067 (LLM Trusted Output Components Manipulation) — the sandbox is a trusted output control that is manipulated
- LLM02 (Insecure Output Handling) — rendered HTML content is not sufficiently constrained before being processed by the application
- LLM06 (Sensitive Information Disclosure) — conversation data is exposed to external parties without user consent
Impact Assessment
Users of the ChatGPT desktop application who had enabled Lockdown Mode under the assumption it provided strong exfiltration protection are most directly affected. Enterprise users sharing sensitive business conversations are at elevated risk, as the attack requires no active user interaction and can be triggered via shared chat links or third-party GPTs. The phishing and malware delivery capabilities extend the threat surface beyond data theft to endpoint compromise.
Mitigation & Recommendations
- Update immediately — ensure the ChatGPT desktop application is running a version patched after September 18, 2026.
- Treat third-party GPTs and shared chats as untrusted — do not open shared conversations from unknown sources within the desktop app.
- Avoid sharing sensitive data in ChatGPT conversations — Lockdown Mode should be treated as one layer of defence, not a complete control.
- Monitor for unexpected network requests — endpoint security tooling should flag anomalous outbound connections originating from the ChatGPT desktop process.
- Review AI application sandboxing — security teams should audit HTML/JavaScript rendering in all AI chat desktop clients for analogous nested frame permission escapes.