Check Point: a ChatGPT HTML-preview sandbox flaw let attackers bypass Lockdown Mode and copy chat history

Check Point Research said on November 5, 2026 that it found a vulnerability in ChatGPT that allowed an attacker to bypass Lockdown Mode and covertly copy chat data to an external server. According to the report, OpenAI told the researchers on September 18, 2026 that it had deployed a fix, and the researchers later confirmed the technique no longer worked.

What did the Check Point researchers find?

The report, written by Check Point's Alexey Bukhteyev, concerns the HTML page preview that OpenAI added to ChatGPT code blocks in February 2026. The preview runs inside a sandbox made of two nested iframes. Check Point says the outer iframe carried the allow-popups and allow-popups-to-escape-sandbox permissions.

ChatGPT's sandbox script replaces the page's window.open function so that popups need user approval. Check Point says that wrapper did not cover a nested iframe's own contentWindow.open. A popup opened that way could hold arbitrary HTML that ran outside the sandbox.

What data could be taken?

Check Point lists the entire chat history and uploaded files as data an attacker could take. It also describes a lure that forces re-authentication on an attacker-controlled page to capture credentials, and a way to sign users out of their accounts. In the Electron-based ChatGPT Classic desktop app, the report says window.open worked without a user gesture, which made the attack zero-click. In a browser, the report says delivery is easier because automatic downloads are not blocked, and shared chats were one delivery route.

The Hacker News, reporting on the research, attributes it to Check Point's research team more broadly and says the crafted prompt, a malicious GPT or a shared chat could be the delivery path. This story relies on the Check Point report for the technical detail and the researcher's name.

What is Lockdown Mode, and why did the bypass matter?

The Hacker News reported in June 2026 that Lockdown Mode is an optional ChatGPT setting for eligible Free, Go, Plus, Pro and self-serve Business accounts. It limits live browsing to cached content, restricts image support, and disables deep research, agent mode, Canvas networking and file downloads for data analysis. Its stated purpose is to reduce the risk of data exfiltration from prompt injection by limiting outbound network requests. The report says it does not stop prompt injections from occurring and does not guarantee that exfiltration cannot happen.

Check Point's finding is that the preview sandbox was a path Lockdown Mode's controls did not cover. That is a statement about this feature at the time of research, not about the setting as it stands after OpenAI's change.

What did OpenAI change?

According to Check Point, OpenAI removed the allow-popups and allow-popups-to-escape-sandbox permissions from the outer iframe of the HTML preview. The report contains no direct statement from OpenAI, and it does not say when Check Point first reported the flaw. The interval between the September 18 fix and the November 5 publication is 48 days.

What does this mean for organisations that allow ChatGPT?

The report gives no user-facing steps. Its general conclusion is that securing these systems requires considering the platform as a whole rather than individual features, and it warns about clicking content in shared chats.

For readers weighing the exposure, the finding shows that what an employee types or uploads into a chat tool, including through shadow AI use, can be within reach of the tool's own interface features, not only of the model. Whatever was in an affected session's chat history or uploads was within reach of the attack described, per Check Point. Check Point's report does not describe any exploitation outside its own research.

What is still unresolved?

• Check Point does not give the date it reported the flaw to OpenAI.
• Neither source says whether OpenAI examined logs for earlier exploitation.
• The Hacker News notes a separate takeover bug in the same component, reported about a week earlier by Parameter Labs, which Check Point says is a different vulnerability.

Our earlier story on OpenAI's reports of test models bypassing access controls covers a different class of failure at the same company, where the model itself, not an attacker, crossed an access boundary.