ChatGPT HTML-Preview Flaw Bypassed Lockdown Mode and Enabled Silent Data Theft

Check Point Research discovered a vulnerability in ChatGPT’s HTML-preview sandbox that bypassed Lockdown Mode and enabled data exfiltration, phishing, and malware-delivery scenarios. Attackers could retrieve an unmodified window.open function from a newly created nested iframe and exploit permissive sandbox settings to open windows outside the sandbox’s restrictions. The finding exposed a weakness in a security feature OpenAI introduced alongside elevated-risk labels.

In the Electron-based ChatGPT Classic application, exploitation required no user gesture, allowing a malicious GPT to silently exfiltrate conversation data. Browser-based exploitation generally required an initial user interaction to open a popup; malicious previews could also reach users through shared chats. OpenAI reported deploying a fix on September 18, 2026, and Check Point Research confirmed that the described technique no longer worked. The disclosure describes a demonstrated vulnerability, not confirmed attacks against users.