EN PT-BR
← Voltar ao feed
high

Check Point: ChatGPT Lockdown Mode bypass via HTML-preview popup sandbox escape enabled zero-click exfiltration and phishing; OpenAI patched

3 fonte(s) · 3 atualização(ões) · publicado 05/11/2026 10:01 · coletado há 3 horas

Matéria consolidada. Reúne 3 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 3 fontes trouxeram em 05/11/2026 22:01; os links antigos trazem para cá.

Fontes: thehackernews.com ↗ research.checkpoint.com ↗ blog.checkpoint.com ↗

Check Point Research (CPR) disclosed a now-patched vulnerability that bypassed Lockdown Mode in ChatGPT. Lockdown Mode is an optional OpenAI setting meant to limit prompt-injection-driven data exfiltration (blog.checkpoint.com, thehackernews.com). The flaw was in the HTML page preview for code blocks, where nested sandboxed frames and popup windows let an attacker escape the sandbox and show attacker-controlled content inside the trusted ChatGPT interface. Abuse scenarios included covert exfiltration of whole chat histories and uploaded files, credential phishing through forced sign-out and spoofed authentication pages, and malware delivery disguised as a fake ChatGPT update (research.checkpoint.com). The attack could be delivered through a malicious prompt, a malicious GPT, or a shared chat, and was demonstrated against both browser and desktop clients. In the Electron-based ChatGPT Classic desktop app it was zero-click: merely conversing with a malicious GPT or shared chat could trigger silent exfiltration to an attacker server (research.checkpoint.com, thehackernews.com). OpenAI deployed a server-side fix on September 18, 2026, and CPR retested and confirmed the technique no longer works. Public disclosure came on November 5, 2026, and no CVE has been assigned in the available sources (thehackernews.com).

Entenda a falha

A vulnerabilidade

This is a sandbox escape in the HTML page preview for code blocks in OpenAI's ChatGPT. It bypasses Lockdown Mode, the optional setting meant to limit prompt-injection data exfiltration. The attacker delivers content through a malicious prompt, a malicious GPT or a shared chat. In browsers the victim generally has to click something in the preview, and no account is needed. In the Electron-based ChatGPT Classic desktop app it is zero-click, because window.open works without a user gesture. The result is silent theft of chat history and uploaded files, credential phishing, and fake-update malware lures. No CVE was assigned. The fix is server-side, so there are no version numbers.

Como funciona

ChatGPT renders user-supplied HTML and JavaScript from a code block inside a sandbox made of two nested iframes. The sandbox isolates the page from cookies, localStorage and the main app, and flags outbound requests. ChatGPT also redefines window.open so popups need user approval. But the iframe permissions still allowed popups and let them escape the sandbox. If the page creates another nested iframe, it can use that frame's own contentWindow.open, which ChatGPT did not intercept. The popup that opens runs outside the sandbox and outside Lockdown Mode. The attacker controls its content, and it keeps the ChatGPT icon, so it can send data out or show phishing pages.

Por que é vulnerável

The cause is a sandbox misconfiguration combined with a bypassable control. The outer preview iframe kept allow-popups and allow-popups-to-escape-sandbox, and protection relied on ChatGPT overriding window.open in the first frame. That override did not cover a freshly created nested frame, which exposed the native function. Lockdown Mode depended on the integrity of this surrounding feature. The fix removed both permissions from the outer HTML-preview sandbox iframe. Check Point says the weakness lay in the wider application environment, not the AI model.

Onde está

The HTML page preview feature in ChatGPT code blocks, specifically the permissions of the outer sandboxed preview iframe (allow-popups and allow-popups-to-escape-sandbox) and the window.open override in the sandbox scripts; no public code or commit is named.

Como foi descoberta

Check Point Research found the flaw; the research is credited to Alexey Bukhteyev, and Eli Smadja, head of research, commented on it. It was reported to OpenAI under responsible disclosure. OpenAI deployed a server-side fix on September 18, 2026, and Check Point retested and confirmed the technique no longer works. Details were published on November 5, 2026. The articles do not say how the weakness was first spotted. A week earlier, Parameter Labs reported a separate ChatGPT sandbox and CSP bypass.

PoC existente, privada

O exploit existe, mas quem o tem não o publicou.

Check Point demonstrated the technique, including zero-click exfiltration of chat messages to an attacker-controlled server in ChatGPT Classic through a malicious GPT, and a fake update lure. The articles show only short snippets and do not say a working exploit or tool was released, so it is treated as private. Since the fix is server-side, urgency for defenders is low. The residual risk is social engineering through popups and shared chats.

Explicação gerada por IA a partir da matéria e dos artigos, em 05/11/2026 22:16.

Detalhes técnicos

  • OpenAI introduced HTML page preview for code blocks in February 2026. It renders user-controlled HTML/JS inside two nested sandboxed iframes, intended to isolate it from the ChatGPT application context, cookies and localStorage (research.checkpoint.com).
  • The sandbox still had allow-popups and allow-popups-to-escape-sandbox enabled. The sandbox's redefined window.open blocked direct popups pending user approval (research.checkpoint.com).
  • An attacker could create a nested iframe and call its own contentWindow.open. This gave access to an unmodified popup function, and the resulting popups ran outside the sandbox because of the escape token (research.checkpoint.com, thehackernews.com).
  • The popups kept the legitimate ChatGPT app icon, while the attacker controlled the title and content. Images and links could be embedded for exfiltration and phishing lures (research.checkpoint.com, blog.checkpoint.com).
  • Because the attacker controls the popup content, a convincing fake ChatGPT update could trick victims into clicking a link and downloading malware (thehackernews.com).
  • In ChatGPT Classic, window.open could fire without a user gesture. The app also allowed window reloading and forced sign-outs, which redirected users to attacker-controlled phishing pages (research.checkpoint.com, blog.checkpoint.com).
  • The disclosure follows a separate report, a week earlier, by Parameter Labs on a ChatGPT sandbox/CSP bypass enabling account takeover via a shared link and a single HTML-preview click. It also follows an earlier Check Point finding of a covert cross-account command channel in ChatGPT's code-execution environments (thehackernews.com).

Remediação

  • OpenAI removed the allow-popups and allow-popups-to-escape-sandbox permissions from the outer HTML-preview sandbox iframe. The fix is server-side, so no patching is needed by users (research.checkpoint.com, thehackernews.com).
  • Users should stay aware of residual social-engineering risk from popups and shared chats (thehackernews.com).
  • Check Point recommends that enterprises gain visibility into AI service usage and enforce policies limiting sensitive data shared with AI platforms. It also advises treating surrounding components (runtimes, connectors, sandboxes) as part of the AI attack surface and minimizing data exposure to reduce the impact of third-party AI platform vulnerabilities (blog.checkpoint.com).

Relatos divergentes

  • Affected client naming: blog.checkpoint.com calls the most severe case the "ChatGPT desktop application", while research.checkpoint.com and thehackernews.com name it ChatGPT Classic. They appear to describe the same Electron-based app.
  • Fix date: blog.checkpoint.com says the fix was deployed "by" September 18, 2026, while research.checkpoint.com and thehackernews.com say it was deployed on that date. The more detailed research.checkpoint.com account is the more authoritative one.

Linha do tempo

  1. thehackernews.com ↗ · pub. 05/11/2026 13:42 · coletado 05/11 20:00

    Researchers Bypass OpenAI ChatGPT Lockdown Mode via HTML Preview Popup Sandbox Escape

    ler a análise desta fonte

    Check Point Research disclosed a now-patched vulnerability that allowed attackers to bypass Lockdown Mode, an optional OpenAI security setting introduced to reduce data-exfiltration risk from prompt injection, in ChatGPT. The flaw resided in the HTML page preview feature inside ChatGPT code blocks, which renders user-supplied HTML/JavaScript inside a sandboxed iframe that normally blocks access to cookies, local storage, and outbound network requests. By creating a nested iframe inside the sandboxed preview and invoking its own window.open function, an attacker could obtain an unmodified popup mechanism that was not subject to the sandbox's restrictions, since the underlying allow-popups and allow-popups-to-escape-sandbox permissions were still enabled. This allowed covert exfiltration of entire chat histories and uploaded files, credential-phishing lures, and malware delivery through a crafted prompt, a malicious GPT, or a shared chat link. In the Electron-based ChatGPT Classic desktop application, window.open could be triggered without any user gesture, making the attack zero-click: simply having a conversation with a malicious GPT was enough to trigger silent exfiltration to an attacker-controlled server.

    Technical Details

    The HTML preview sandbox uses two nested iframes; researchers found that the underlying sandbox permissions "still allowed popups and permitted them to escape the sandbox," and a nested frame let the attacker "access an unmodified popup function and bypass the restrictions." Because the attacker fully controls the popup content, it could be used to display convincing lures, such as a fake ChatGPT update, and trick the victim into downloading malware by persuading them to click on a link (thehackernews.com). In ChatGPT Classic, the Electron app also allowed window reloading and forced sign-outs to stage credential-phishing pages (research.checkpoint.com). This disclosure follows a separate week-earlier report by Parameter Labs on a ChatGPT sandbox/CSP bypass enabling account takeover via a shared link and a single HTML-preview click, and an earlier Check Point finding of a covert cross-account command channel in ChatGPT's code-execution environments.

    Fix Details

    On September 18, 2026, OpenAI informed Check Point that it had deployed a fix by removing the allow-popups and allow-popups-to-escape-sandbox permissions from the outer HTML-preview sandbox iframe (research.checkpoint.com). Check Point retested the exploitation technique after the fix and confirmed it no longer worked (research.checkpoint.com). No CVE identifier has been assigned to this issue in the available sources.

    Remediation

    The fix is already deployed server-side by OpenAI; no user action is required beyond ensuring awareness of residual social-engineering risk from popups and shared chats. The finding underscores that AI platform security controls, such as Lockdown Mode, depend on the integrity of surrounding application features (sandbox implementations, popup handling) and not solely on the model itself.

  2. research.checkpoint.com ↗ · pub. 05/11/2026 11:00 · coletado 05/11 12:01

    Check Point Finds ChatGPT Lockdown Mode Bypass Enabling Zero-Click Data Exfiltration, Phishing and Malware Delivery

    ler a análise desta fonte

    Check Point Research disclosed a vulnerability in ChatGPT's HTML-preview sandbox that allowed attackers to bypass Lockdown Mode, OpenAI's advanced setting meant to block prompt-injection-based data exfiltration. By nesting an additional iframe and invoking its contentWindow.open function, an attacker could escape the sandbox restrictions (allow-popups, allow-popups-to-escape-sandbox) and open popups displaying arbitrary attacker-controlled content inside the trusted ChatGPT interface. The flaw enabled covert exfiltration of entire chat histories and uploaded files, phishing via spoofed application windows disguised as legitimate ChatGPT update prompts, and credential theft by forcing user sign-out and re-authentication on attacker-controlled pages. In the Electron-based ChatGPT Classic app, the exploit required zero user interaction, as window.open could be triggered silently, merely having a conversation with a malicious GPT or shared chat was enough to trigger data exfiltration to an attacker server. The attack could be delivered through a malicious prompt, a malicious GPT, or a shared chat, and was demonstrated against both the browser and desktop clients.

    Technical Details

    OpenAI introduced HTML page preview for code blocks in February 2026, rendering user-controlled HTML/JS inside two nested sandboxed iframes to isolate it from the ChatGPT application context, cookies, and localStorage. However, the sandbox left allow-popups and allow-popups-to-escape-sandbox enabled; while the sandbox's redefined window.open blocked direct popups pending user approval, creating a nested iframe and calling its own contentWindow.open bypassed this restriction entirely, since the inner iframe's popup windows execute outside the sandbox due to the escape token. This allowed attacker-controlled popups retaining the ChatGPT app icon with attacker-controlled titles and content, as well as image/link embedding for exfiltration and phishing lures.

    Remediation

    Check Point Research responsibly disclosed the vulnerability to OpenAI, which deployed a fix on September 18, 2026 by removing the allow-popups and allow-popups-to-escape-sandbox permissions from the outer HTML-preview sandbox iframe. Check Point confirmed the exploitation technique no longer works after retesting.

  3. blog.checkpoint.com ↗ · pub. 05/11/2026 10:01 · coletado 05/11 12:00 primeiro registro

    ChatGPT Lockdown Mode Bypass Enabled Zero-Click Data Exfiltration, Phishing and Malware Lures

    ler a análise desta fonte

    Check Point Research (CPR) discovered and responsibly disclosed a vulnerability that bypassed ChatGPT Lockdown Mode, a security feature intended to limit prompt-injection-driven data exfiltration. The flaw resided in how HTML page previews inside ChatGPT code blocks handled nested sandboxed frames and popup windows, allowing an attacker to escape the sandbox restrictions meant to isolate rendered content. Exploitation scenarios included silent chat data exfiltration, credential phishing via spoofed authentication pages, and malware delivery disguised as a fake ChatGPT update, all presented within the trusted ChatGPT interface. The most severe case involved the Electron-based ChatGPT desktop application, where the popup abuse worked without user interaction, enabling zero-click exfiltration of conversation data via a malicious GPT. OpenAI deployed a fix by September 18, 2026, removing the sandbox permissions that enabled the technique, and CPR confirmed the bypass no longer works.

    Technical Details

    The bypass exploited nested sandboxed iframes within ChatGPT's HTML preview feature: while ChatGPT intercepted direct attempts to open new windows, underlying sandbox permissions still allowed popups to be spawned from a secondary nested frame, granting access to an unmodified popup function that escaped the original sandbox restrictions. In the desktop app, these popups retained the legitimate ChatGPT application icon while attacker-controlled title and content could be injected, and the main application window could be manipulated to forcibly sign users out, redirecting them to attacker-controlled phishing pages.

    Remediation

    OpenAI removed the sandbox permissions enabling the popup escape technique. Check Point recommends enterprises gain visibility into AI service usage, enforce policies limiting sensitive data shared with AI platforms, treat surrounding application components (runtimes, connectors, sandboxes) as part of the AI attack surface, and minimize data exposure to reduce impact from third-party AI platform vulnerabilities.