On 5 November 2026 Check Point Research disclosed a way around Lockdown Mode in ChatGPT. Lockdown Mode is an optional OpenAI setting meant to stop prompt injection from sending sensitive data out of ChatGPT: it limits live web access and internet-hosted images, and turns off Deep Research, Agent Mode, live connectors and file downloads.
How it worked: ChatGPT can show an HTML page preview of code in a code block, run inside nested sandboxed frames. ChatGPT blocked direct attempts to open new windows, but the sandbox still allowed pop-ups, and those pop-ups could escape the sandbox. By creating one more nested frame, the researchers reached an unmodified pop-up function, and whatever opened that way was no longer restricted by Lockdown Mode.
What an attacker could do: quietly send chat data to their own server; show phishing pages, including one demo that signed the user out and sent them to a fake login page; or offer malware as a fake ChatGPT update in a pop-up that kept the ChatGPT icon. The attack could start from a malicious prompt, a malicious custom GPT or a shared chat. The worst case was the older Electron-based ChatGPT desktop app, where the pop-up needed no click at all: in Check Point's demo a malicious GPT leaked chat messages during a normal conversation. Delivering malware still needed the victim to click.
Status: Check Point says OpenAI fixed the flaw after responsible disclosure, deploying the fix on 18 September 2026 by removing the pop-up permissions from the sandbox; Check Point retested and the technique no longer works. Neither source reports any attacks in the wild, and no CVE was assigned.
