Researchers Detail ChatGPT Lockdown Mode Bypass Enabling Data Exfiltration and Phishing

Summary

Check Point researchers described a ChatGPT HTML-preview sandbox flaw that bypassed Lockdown Mode, enabling chat-data exfiltration, phishing, and malware delivery. OpenAI removed permissive popup settings; researchers retested and confirmed the technique no longer works

Key points

Researchers said permissive popup settings in nested HTML-preview iframes enabled a bypass of ChatGPT Lockdown Mode.
The bypass could expose chat history and uploaded files to covert exfiltration, according to the researchers.
Attackers could use spoofed ChatGPT windows for phishing or to lure users into downloading malware.
In ChatGPT Classic, researchers demonstrated silent chat-message exfiltration without user interaction.
Researchers also described a credential-theft scenario that could prompt users to re-authenticate on an attacker-controlled page.
OpenAI told Check Point it deployed a fix on September 18, 2026, by removing the permissive popup settings; researchers retested and confirmed the described technique no longer worked.

Article Details

Attack Vectors: A malicious prompt, malicious GPT, or shared chat can supply crafted HTML for ChatGPT's page-preview feature.
A nested iframe's contentWindow.open function can create a popup that escapes the HTML-preview sandbox because the outer iframe allows popups to escape the sandbox.
The popup can display attacker-controlled HTML that impersonates the ChatGPT interface, luring users to download malware or enter credentials on a fraudulent page.
In ChatGPT Classic, the popup behavior can silently exfiltrate chat history to an attacker-controlled server without user interaction.
An attacker can reload the main application window and force a sign-out, then lure the user into re-authenticating on an attacker-controlled page.
Defensive Notes: OpenAI reported deploying a fix on 2026-09-18 by removing the allow-popups and allow-popups-to-escape-sandbox permissions from the outer HTML-preview sandbox iframe; Check Point Research retested and confirmed the described exploit no longer worked.
Lockdown Mode restricts live web access to cached content, blocks internet images, disables network requests from Canvas-generated code, and turns off Deep Research, Agent Mode, live connectors, and file downloads; the reported vulnerability bypassed its protections.

MITRE ATT&CK

T1056.003 · Web Portal CaptureThe attacker can force a sign-out and lure the user into re-authenticating on an attacker-controlled page to steal credentials.T1059.007 · JavaScriptThe crafted HTML preview uses JavaScript, including a nested iframe's contentWindow.open function, to open a popup outside the intended sandbox restrictions.T1105 · Ingress Tool TransferThe attacker can use a spoofed ChatGPT window to induce a victim to download malware disguised as an application update.T1204.001 · Malicious LinkIn browser-based malware delivery, the victim must click content in a shared chat; the ChatGPT Classic download scenario also requires a click on the download link.T1566.002 · Spearphishing LinkA malicious shared chat or popup can present a link or lure that directs the victim to attacker-controlled content for phishing or malware delivery.T1567 · Exfiltration Over Web ServiceThe vulnerability can covertly send chat history from ChatGPT Classic to an attacker-controlled external server.

Vendors

OpenAIOpenAI recently introduced Lockdown Mode, an optional advanced security setting designed to protect sensitive user data from prompt injection-based exfiltration attacks.

Products

ChatGPTChatGPT Lockdown Mode Bypass: Phishing, Malware Delivery, and Silent Data Exfiltration ChatGPT ClassicIn ChatGPT Classic, the attack requires zero user interaction: simply having a conversation is enough to trigger silent data exfiltration.