Check Point got around ChatGPT Lockdown Mode through HTML previews; OpenAI fixed it in September

On November 5, 2026, Check Point Research published a way around ChatGPT's Lockdown Mode, the optional setting meant to stop prompt injection from sending conversation data to outside servers. The flaw was in the HTML page preview that ChatGPT added to code blocks in February 2026. OpenAI told the researchers on September 18, 2026 that a fix was deployed, and Check Point says its retest confirms the technique no longer works. No CVE or severity rating has been published, and we found no public OpenAI statement about the issue.

The preview renders a page inside two nested sandboxed frames, and ChatGPT replaces the page's popup function so that new windows need the user's approval. The outer frame, however, still allowed popups that escape the sandbox. Researcher Alexey Bukhteyev found that the page could create one more frame of its own and call that frame's untouched popup function to open a real window. Code placed in that window ran outside the sandbox, and so outside Lockdown Mode's limits on outbound requests.

An attacker could deliver such a page through a crafted prompt, a malicious custom GPT or a shared chat. In the Electron-based ChatGPT Classic desktop app, the window opened without any click: in Check Point's demo, a malicious GPT quietly sent the whole chat history to an attacker's server while the user simply kept chatting. In a web browser, opening the window needed a click on the preview, but a shared chat was enough and the victim did not need an account. The same trick could show a fake ChatGPT update that downloads malware, or sign the user out and steer them to a look-alike sign-in page to steal credentials.