A flaw let attackers get around ChatGPT's Lockdown Mode and steal chat history
IA en un minuto newsroom · Editor: Jon Elgezabal
In 30 seconds
Check Point Research discovered how to open pop-up windows from ChatGPT's HTML preview, something that rendered Lockdown Mode useless. With that trick, conversations could be stolen, the interface mimicked with rigged windows or harmful programs handed out, and in ChatGPT Classic not even a click was needed. OpenAI pulled the permissions at fault and the technique is now closed off.
On Thursday, November 5, Check Point Research, Check Point's research team, published the details of a ChatGPT vulnerability that let an attacker get past Lockdown Mode. Lockdown Mode is an extra layer of protection that signed-in users can choose to turn on: it lowers the risk of a prompt injection pulling out private data by shutting the routes out of the conversation. With it switched on, browsing is limited to cached content, images from the internet do not load, Canvas code cannot make network requests, and file downloads, live connectors, agent mode and Deep Research all stop working.
The weak spot was the HTML page preview in code blocks, which OpenAI added to ChatGPT in February 2026. That preview runs inside an isolated environment that warns the user and asks for approval whenever the page tries to reach an outside site. But the isolation kept two pop-up permissions, and the researchers found a way to open one without going through that prompt. Whatever loaded in the new window was then outside the isolated environment. According to Check Point, that opened the door to carrying off chat history and uploaded files, showing fake windows that look like ChatGPT to ask for passwords, and slipping in malware disguised as an update. The way in could be a booby-trapped prompt, a shared chat or a GPT built with bad intent; in the browser, opening a shared chat was enough, with no account needed.
The most serious case was ChatGPT Classic, the desktop app, where the window opened without the person doing anything. Check Point shows it in a video in which a malicious GPT sends the conversation's messages to an attacker's server while the user is chatting with it. It also managed to reload the main window and sign the user out, the step before asking them to log back in on a fake page. These are proofs of concept: the researchers do not mention real attacks using this technique.
Check Point alerted OpenAI before going public. On September 18, OpenAI told it that it had rolled out the fix, which removes those two permissions from the preview's isolated environment, and Check Point confirmed in a new test that the technique no longer works.
Why it matters · analysis and opinion
A security mode only protects as far as the newest feature living alongside it. Lockdown Mode closed off the known exits well, and a convenience added later, the page preview, was enough to open another one. The fix is already rolled out and there is no record of anyone exploiting it, so with this particular flaw users have nothing to do. The lesson goes further: turning on a restricted mode is no reason to paste into the chat data you would not trust to any other outside service. For companies using ChatGPT, the sensible move is to treat third-party GPTs and shared chats like any unknown link, know which desktop apps staff have installed and keep them up to date.
Official source: Check Point Research · Written with the help of AI: how we make the news
