OpenAI Fixes ChatGPT Lockdown Mode Bypass Enabling Silent Chat Exfiltration

Check Point Research disclosed a flaw in ChatGPT’s HTML-preview sandbox that bypassed Lockdown Mode, enabling conversation-data exfiltration and phishing and malware-delivery scenarios. Attackers could obtain an unrestricted window-opening function from a nested iframe and exploit permissive sandbox settings to open attacker-controlled windows outside the intended restrictions on outbound communication. Researchers demonstrated a malicious GPT silently transmitting conversation data to an attacker-controlled server without a user gesture in the Electron-based ChatGPT Classic desktop application; the underlying bypass was not limited to desktop use.

Other demonstrated scenarios used attacker-controlled windows to impersonate ChatGPT updates or force sign-outs followed by credential-phishing lures. File downloads in the desktop application still required a user click, distinguishing those scenarios from the zero-click exfiltration demonstration. OpenAI told researchers on September 18, 2026, that it had deployed a fix removing the relevant sandbox permissions, and Check Point’s subsequent testing confirmed that the demonstrated exploitation technique no longer worked.