Check Point Research (CPR) discovered a vulnerability that bypassed ChatGPT Lockdown Mode, a security feature designed to reduce prompt-injection-driven data exfiltration. The flaw could enable silent chat data theft, phishing and malware delivery, including zero-click data exfiltration in the ChatGPT desktop application.
OpenAI fixed the vulnerability following responsible disclosure, but the finding raises a broader enterprise security issue: AI security controls are only as strong as the wider application environment around them.
Key Findings
- Check Point Research bypassed ChatGPT Lockdown Mode, a security feature specifically designed to limit prompt-injection-driven data exfiltration.
- The vulnerability could enable multiple attack scenarios, including chat data exfiltration, credential phishing and malware delivery through a trusted ChatGPT interface.
- The most significant risk demonstrated is the potential for data exfiltration without user interaction, regardless of how ChatGPT is accessed. While CPR used the desktop application in its demonstration, the underlying technique is not limited to the desktop environment.
- The vulnerability originated in the wider application environment, demonstrating how weaknesses outside the AI model itself can undermine dedicated AI security controls.
- OpenAI fixed the vulnerability following responsible disclosure, and Check Point Research confirmed that the technique described in the research no longer works.
What Is ChatGPT Lockdown Mode?
OpenAI introduced Lockdown Mode as an optional advanced security setting designed to reduce the risk of sensitive information leaving ChatGPT as the result of prompt injection. These attacks attempt to manipulate an AI system through malicious instructions hidden within content it processes, potentially causing the AI or one of its tools to take an unintended action.
One potential outcome is data exfiltration, where sensitive information is sent to an attacker-controlled destination without the user realizing it. Lockdown Mode reduces this risk by restricting several potential outbound channels, including live web access and internet-hosted images, while disabling capabilities such as Deep Research, Agent Mode, live connectors and file downloads.
These safeguards make it considerably harder for malicious instructions to move private information outside ChatGPT. Check Point Research, however, found that another feature within the application created an alternative path around these restrictions.
How Check Point Research Bypassed ChatGPT Lockdown Mode
The vulnerability involved HTML page previews inside ChatGPT code blocks, a feature that allows HTML content to be rendered directly within the ChatGPT experience. Because executing user-controlled HTML and JavaScript can create security risks, this content is placed inside a sandbox designed to separate it from the main ChatGPT application.
The sandbox prevented rendered content from directly accessing information such as ChatGPT cookies, local storage and the main application interface. It also controlled attempts to communicate with external resources and typically required user approval before opening an external URL.
Check Point Research discovered a weakness in the way popup windows were handled within this environment. The HTML preview used nested sandboxed frames, and while ChatGPT intercepted direct attempts to open new windows, the underlying sandbox permissions still allowed popups and permitted them to escape the sandbox.
Researchers found that by creating another nested frame within the rendered page, it was possible to access an unmodified popup function and bypass the restrictions placed on the original HTML preview. Content opened through this route was no longer subject to the same sandbox restrictions, providing a way to circumvent the protections of Lockdown Mode.
The significance extends beyond the individual implementation flaw. Lockdown Mode was specifically intended to reduce the possibility of data leaving a conversation through potentially malicious outbound requests, yet a weakness in another application feature provided an alternative path around that security boundary. This demonstrates how security controls designed for AI can be affected by components elsewhere in the application.
Figure 1 – ChatGPT Lockdown Mode notification displayed when Canvas tries to access an external resource.
Figure 2 – HTML page preview in ChatGPT.
From Data Exfiltration to Phishing and Malware Delivery
Check Point Research found that the vulnerability could be applied to several potential attack scenarios, including data exfiltration, credential theft and malware delivery. An attack could potentially originate from a malicious prompt, malicious GPT or shared chat, depending on the scenario.
Because an attacker could control the content displayed in the popup window, it could also be used to create convincing social-engineering lures within an environment users already trust. In the ChatGPT desktop application, for example, the new window retained the ChatGPT application icon while allowing its title and content to be controlled by the attacker.
Researchers demonstrated how this could be used to present a fake ChatGPT update and encourage the victim to download malware. They also found that the main application window could be manipulated in certain ways, including forcibly signing the user out, creating the possibility of directing a victim to an attacker-controlled authentication page designed to steal credentials.
In the desktop application, downloading a file still required the victim to click a link. The research nevertheless demonstrates how compromising the boundary around a trusted AI interface could make phishing and malware lures more convincing by presenting them within an environment the victim already recognizes.
Why Zero-Click Data Exfiltration Increased the Risk
The most serious scenario identified by Check Point Research involved the Electron-based ChatGPT desktop application, where the popup behavior worked without requiring a user gesture. This removed an important barrier to exploitation because a victim would not necessarily need to click a link or approve an action before the attack could begin.
Researchers demonstrated the scenario using a malicious GPT that could silently leak chat messages to an attacker-controlled server while the victim was having a conversation. In practical terms, this meant that simply interacting with malicious content could potentially be enough to expose information from the conversation.
For organizations, that distinction is particularly important as employees increasingly use AI assistants as part of their everyday workflows. Conversations may include confidential business information, uploaded documents or other sensitive context, increasing the potential impact if an attacker finds a way to cross the boundaries intended to protect that data.
What This Research Means for Enterprise AI Security
The vulnerability demonstrates why AI security needs to extend beyond the model and individual safeguards such as Lockdown Mode. Modern AI platforms combine models with applications, browser and desktop runtimes, sandboxes, code-execution environments and connectors, meaning weaknesses elsewhere in the environment can potentially undermine security controls designed to protect the AI itself.
As AI systems gain greater access to corporate data and applications, organizations should consider several practical measures:
- Gain visibility into AI usage: Understand which AI services employees are using and where corporate information is being shared.
- Control sensitive data exposure: Establish policies and technical controls around the types of information that employees can share with AI services.
- Look beyond model security: Consider the applications, runtimes, connectors and other components surrounding the model as part of the overall AI attack surface.
- Reduce the impact of third-party vulnerabilities: Limit the sensitive information available to AI services so that a compromise does not automatically expose everything a user or organization has shared.
This is also where Check Point’s broader AI security approach is relevant. The value in this scenario is not that an enterprise security product would have fixed this specific ChatGPT vulnerability, but that visibility into AI usage and controls over what information can be shared with AI services can help reduce exposure when weaknesses emerge in third-party platforms.
Check Point Research responsibly disclosed the vulnerability to OpenAI, which informed researchers on September 18, 2026, that it had deployed a fix removing the sandbox permissions that enabled the technique. Check Point Research subsequently retested the issue and confirmed that the exploitation method described in the research no longer works.
For enterprises adopting AI at scale, the lesson extends beyond this individual ChatGPT vulnerability. As AI assistants become increasingly capable of executing code, handling files and connecting to external services, security strategies need to account for the wider environment surrounding the model. Greater visibility into AI usage and stronger controls over sensitive corporate information can help organizations adopt these capabilities while reducing the potential impact when vulnerabilities emerge.
For the full technical analysis, read the research from Check Point Research here.
