ChatGPT Lockdown Mode Bypassed via HTML Popups

The sandbox around ChatGPT's HTML page previews was supposed to be the kind of boundary an attacker could not cross. Inside it, rendered HTML and JavaScript were kept away from cookies, local storage, and outbound network calls, and Lockdown Mode was meant to narrow those outbound requests further still. According to research published by Check Point, a gap in how popup windows were handled let crafted content step outside that boundary entirely.

The security firm has disclosed details of the vulnerability, which it describes as now patched. Check Point says the flaw allowed silent theft of chat data, phishing, and malware delivery, including zero-click exfiltration in the ChatGPT desktop application.

What Lockdown Mode was built to stop

OpenAI introduced Lockdown Mode in June 2026 as an optional setting designed to minimize data exfiltration risks that arise from prompt injections. The concern it addresses is straightforward: if a model can be steered by text it ingests, an attacker who controls that text may be able to steer it into sending data somewhere it should not go.

The feature works by acting as a barrier. It limits outbound network requests, which are the usual route for moving sensitive information out to infrastructure an attacker controls. Fewer permitted requests means fewer channels through which a conversation's contents can leave.

That protection sits on top of an existing mechanism. ChatGPT code blocks can render HTML directly in the application through page previews, and because executing user-supplied HTML and JavaScript carries its own risks, that content is placed inside a sandbox. The sandbox keeps the rendered content from reaching application data such as cookies and local storage, and it also prevents the content from communicating with external resources without user consent.

The popup route out of the sandbox

Check Point found a loophole in how popup windows were handled during HTML previews. The preview used nested sandboxed frames. ChatGPT intercepted direct attempts to open new windows, but the underlying sandbox permissions still allowed popups, and permitted them to escape the sandbox.

"The HTML preview used nested sandboxed frames, and while ChatGPT intercepted direct attempts to open new windows, the underlying sandbox permissions still allowed popups and permitted them to escape the sandbox," Smadja explained.

— Eli Smadja, head of research at Check Point

The second step was to get at a popup function that had not been modified. By creating another nested frame within the rendered page, it was possible to reach that unmodified function and bypass the restrictions placed on the original HTML preview. Content opened through this route was no longer subject to the same sandbox restrictions, which provided a way to circumvent Lockdown Mode.

In other words, the protections applied to the original preview did not follow the content once it was opened through the alternative path. The escape did not depend on breaking the sandbox itself; it depended on reaching a route the application had not closed.

Delivery through prompts and shared chats

Once the restrictions are bypassed, Check Point says a threat actor can use the vulnerability to exfiltrate data or chat messages, or to deliver malicious payloads. The delivery vectors it lists are a crafted prompt, a malicious GPT, or a shared chat.

The popup itself is under the attacker's full control. That matters for a second reason beyond data theft: because the attacker decides what appears in the window, the popup can be used to render convincing social-engineering lures. Check Point gives the example of a fake ChatGPT update, which could persuade a victim to click a link and download malware.

Because content opened this way renders outside the restrictions that normally apply, the phishing page is not obviously separated from the application the user is already working in. The lure and the delivery mechanism come from the same place.

A flaw outside the model's scope

The underlying issue is not limited to the Electron-based desktop environment, according to Check Point. That detail places the weakness in application plumbing rather than in the model's behavior, and it is the point the researchers return to in their conclusions.

Following responsible disclosure, the vulnerability was addressed by OpenAI on September 18, 2026. The fix arrived before Check Point's public write-up, and the firm's report describes the issue as now patched.

Smadja framed the finding in terms of how security controls relate to the rest of an application:

"The finding raises a broader enterprise security issue: AI security controls are only as strong as the wider application environment around them."

— Eli Smadja, head of research at Check Point

Security boundary, alternative path

In the same report, Smadja described the gap between Lockdown Mode's stated purpose and what the popup route allowed:

"Lockdown Mode was specifically intended to reduce the possibility of data leaving a conversation through potentially malicious outbound requests, yet a weakness in another application feature provided an alternative path around that security boundary," Smadja said.

— Eli Smadja, head of research at Check Point

The sequence described by the researchers is worth separating into its parts. Lockdown Mode constrained outbound requests. The sandbox constrained the rendered HTML. Neither of those constraints was defeated directly. What failed was the seam between the preview, the popup handling, and the sandbox permissions underneath, where an unmodified function remained reachable through a nested frame.

A week after the share-link attack

The disclosure comes a week after Parameter Labs detailed a way to bypass ChatGPT's sandbox and content security policy and take over anyone's account simply by sending an attacker-controlled public ChatGPT share link and prompting them to click the HTML preview once. If the HTML block is marked as previewable, it opens automatically.

Security researcher Mukul Goyal described that attack in terms of the sharing feature users already rely on:

"An attacker could create a malicious conversation, publish it using ChatGPT's normal sharing feature, and send the link to another user," security researcher Mukul Goyal said. "When the victim opened the share, the payload executed as chatgpt[.]com with access to the victim's authenticated web session."

— Mukul Goyal, security researcher

Both findings turn on the same underlying feature: HTML content rendered from within a conversation. One attack targeted the sandbox and content security policy around that rendering; the other targeted the popup handling used during previews.

The cross-account channel earlier in September

Earlier in September, Check Point also demonstrated a covert cross-account command channel. Through it, an attacker could use a victim's ChatGPT session to run hidden tasks with the tools, data, and connected apps available to that session, alongside the visible conversation.

"The victim could receive a normal answer to their visible request while the attacker's task was processed separately and its result returned across accounts," Check Point said. "The channel operated through code-execution environments belonging to different ChatGPT accounts."

— Check Point

The firm said the hidden instruction could be delivered through a malicious prompt, a shared ChatGPT conversation, or a custom GPT. Once it was present in the victim's conversation context, an ordinary message could trigger the attacker-controlled task without revealing it in the visible response. The same delivery vectors — prompt, shared conversation, custom GPT — recur across the three ChatGPT findings.

A wider run of agent weaknesses

Check Point's report arrives alongside a number of security shortcomings found in AI-driven tools and services over the past few months, each aimed at tricking a system into spilling secrets or taking unauthorized actions.

• SkillJacking, an attack that hijacks dependencies used by skills — repositories, packages, domains, or cloud apps — to compromise every agent installing them.
• Embrace (EMbedded BRowser - Arbitrary Code Execution, Arbitrary Content Exfiltration, and Arbitrary Context Emulation), a set of vulnerabilities in built-in browsers associated with five AI coding assistants: Cursor, GitHub Copilot, OpenAI Codex, Microsoft Visual Studio Code, and Anthropic Claude Desktop. The issues could be exploited to execute code on a host machine, read and steal files, or spoof browser address bars.
• Repeat-After-Me, a technique targeting LangChain LangGraph, Microsoft Agent Framework, Microsoft AutoGen, Google Agent Development Kit 2.0, AWS Strands Agents, and CrewAI that tricks them into running tool calls via a seemingly benign text-repetition request.
• AgentCorruption, a vulnerability allowing an attacker to interact with an exposed AI agent on AWS Bedrock AgentCore, use prompt injection to influence it, extract its IMDS credentials, and use those to access other agents, read private conversations, steal connected-tool credentials, and manipulate agent behavior.
• Cryptographic Context Injection, a vulnerability in SpaceXSI Grok and GitHub Copilot CLI that could read a developer's local files and send them to an external server from a single web page via an indirect prompt injection hiding malicious instructions inside AES-encrypted text.
• SalesBleed, a zero-click vulnerability that could extract sensitive account data from Salesforce Agentforce by using the Web-to-Lead form to plant an indirect prompt injection payload.
• not-a-mused, a proof-of-concept attack that lets an unprivileged local attacker or process redirect Meta Muse's dictation traffic and abuse the permissions granted to the AI assistant to perform arbitrary actions.
• Plugin4Shell, a zero-click vulnerability for AI supply chain attacks that silently swaps a trusted plugin for a malicious one while bypassing SHA pinning.
• BragJack, an attack that hijacks AI agents built into browsers including Google Chrome, Microsoft Edge, Opera Neon, Perplexity Comet, and Anthropic Claude in Chrome, using an already installed malicious browser extension with prompt forcing.
• Sampling drift, a behavioral effect showing that adding an invisible watermark to an LLM's output can unintentionally change model behavior, including which tools an agent invokes, and likely weaken safety refusals.
• A set of attacks that exploit customer support AI agents to compose and send phishing emails, invoke tool calls, and bypass MFA protections.
• PuzzleMask, a prompt-crafting technique that bypasses quick LLM-based policy checks by a lightweight gatekeeper model by planting the malicious instruction in a specially crafted prose wrapper, after which a more powerful target model processes the payload.
• Workflow Identity Hijacking, a technique that sends normal, benign requests through an unauthenticated entry point, causing an enterprise AI pipeline to process the request and execute the action as designed.
• PleaseFix, a zero-click vulnerability class that hijacks AI agents in agentic browsers by placing malicious instructions inside emails, calendar invitations, or web pages and exploiting intent collision.
• A set of vulnerabilities in AI coding agents from Anthropic, Google, and OpenAI that could trick them into handing over a victim's secrets, achieve persistent instruction poisoning by modifying the AGENTS.md file, and compromise software releases through prompt injections in untrusted inputs such as GitHub issues.

Two of those entries carry their own quoted commentary. On Plugin4Shell, Air Security described the verification gap the attack relies on:

"The agent checks out the exact commit the marketplace pinned but never verifies it landed there, so an attacker who controls the plugin's repo makes the checkout resolve to malicious code while the pin still looks honored," Air Security said. "The result is zero-click remote code execution across Claude Code, Codex, GitHub Copilot, and Gemini CLI."

— Air Security

On sampling drift, Lasso Security noted that the effect is not confined to plain harmful prompts:

"Watermarking changes refusal behavior on bare harmful requests, but the effect is more pronounced when the same requests are paired with the prompt-injection technique," Lasso Security said. "On several models, watermarking then makes the model more likely to answer harmful requests that it would otherwise refuse."

— Lasso Security

On Workflow Identity Hijacking, Noma Security pointed to the permission gap at the center of the technique:

"The core failure is that the requester had no authority to make that request," Noma Security said. "When an AI workflow performs downstream actions, it executes using high-privilege service accounts or developer API keys rather than enforcing the permissions of the external user. As a result, AI workflows become unauthenticated proxies for privileged actions and silent data exfiltration."

— Noma Security

And Novee Security summarized the direction the list points in:

"Agents are becoming the default infrastructure across CI/CD, messaging, triage, incident response, and support," Novee Security said. "The more autonomous they get, the more the harness decides what's safe on your behalf, and the more untrusted input reaches real execution."

— Novee Security

Why the popup flaw matters beyond ChatGPT

The Lockdown Mode bypass is a reminder that a security setting is only one component of the surface it protects. Lockdown Mode constrained outbound requests, and the sandbox constrained rendered content, but the popup handling and sandbox permissions underneath offered a path that neither control accounted for. For organizations that treat an AI assistant's safety toggle as a settled matter, this suggests the surrounding application deserves the same scrutiny as the model itself.

For defenders, the practical consequence is that the delivery vectors are familiar ones: a crafted prompt, a malicious GPT, or a shared chat. Those are ordinary ways users interact with these tools, which means filtering or policy that looks only at model output may not catch a payload that never needed the model to misbehave. The popup route did not require the model to leak anything on its own.

The pattern across the broader list is similar. SkillJacking, Plugin4Shell, Workflow Identity Hijacking, and the Lockdown Mode bypass each describe a control that held on the path it was designed for while another path remained open. The finding also indicates that fixes are arriving per-issue rather than as a single change: OpenAI addressed this one on September 18, 2026, while the surrounding ecosystem continues to produce a steady run of bypasses. Enterprises building on agents could reasonably treat the whole stack — the application feature, the sandbox, the permissions, the connected tools — as the security boundary, because that appears to be how attackers are approaching it.