Check Point: ChatGPT Lockdown Mode bypass via HTML-preview popup sandbox escape enabled zero-click exfiltration and phishing; OpenAI patched
Matéria consolidada. Reúne 6 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 5 fontes trouxeram em 06/11/2026 06:02; os links antigos trazem para cá.
Fontes: gbhackers.com ↗ securityonline.info ↗ thehackernews.com ↗ research.checkpoint.com ↗ blog.checkpoint.com ↗
Check Point Research (CPR) disclosed a now-patched vulnerability that bypassed Lockdown Mode in ChatGPT. Lockdown Mode is an optional OpenAI setting meant to limit prompt-injection-driven data exfiltration (blog.checkpoint.com, thehackernews.com). The flaw was in the HTML page preview for code blocks, where nested sandboxed frames and popup windows let an attacker escape the sandbox and show attacker-controlled content inside the trusted ChatGPT interface. Abuse scenarios included covert exfiltration of whole chat histories and uploaded files, credential phishing through forced sign-out and spoofed authentication pages, and malware delivery disguised as a fake ChatGPT update (research.checkpoint.com). The attack could be delivered through a malicious prompt, a malicious GPT, or a shared chat, and was demonstrated against both browser and desktop clients. In the Electron-based ChatGPT Classic desktop app it was zero-click: merely conversing with a malicious GPT or shared chat could trigger silent exfiltration to an attacker server (research.checkpoint.com, thehackernews.com, gbhackers.com). Researcher Alexey Bukhteyev published the findings on November 5, 2026 (gbhackers.com). CPR notified OpenAI first, and OpenAI deployed a server-side fix on September 18, 2026, before public disclosure. CPR retested and confirmed the technique no longer works (securityonline.info). No CVE has been assigned in the available sources (thehackernews.com).
Entenda a falha
A vulnerabilidade
This is a sandbox escape in the HTML page preview for code blocks in OpenAI's ChatGPT. It bypasses Lockdown Mode, the optional setting meant to limit prompt-injection data exfiltration. The attacker needs only to get content in front of the victim through a malicious prompt, a malicious GPT or a shared chat. In browsers the victim generally has to click in the preview, and no account is needed. In the Electron-based ChatGPT Classic desktop app it is zero-click, because window.open works without a user gesture. The attacker gets silent theft of chat history and uploaded files, credential phishing and fake-update malware lures. No CVE was assigned, and the fix is server-side, so there are no version numbers.
Como funciona
ChatGPT renders user-supplied HTML and JavaScript from a code block inside a sandbox made of two nested iframes. The sandbox isolates the page from cookies, localStorage and the main app, and intercepts outbound requests with warnings. ChatGPT also redefines window.open so popups need user approval. But the iframe permissions still allowed popups and let them escape the sandbox. If the page creates another nested iframe, it can use that frame's own contentWindow.open, which ChatGPT did not intercept. The popup that opens runs outside the sandbox and outside Lockdown Mode, with attacker-controlled content and the ChatGPT icon, so it can send data out or show phishing pages.
Por que é vulnerável
The cause is a sandbox misconfiguration combined with a bypassable control. The outer preview iframe kept allow-popups and allow-popups-to-escape-sandbox, and protection relied on ChatGPT overriding window.open only in the top-level page. That override did not cover a freshly created nested frame, which exposed the native function. Lockdown Mode depended on the integrity of this surrounding feature. The fix removed both permissions from the outer HTML-preview sandbox iframe. Check Point says the weakness lay in the wider application environment, not in the AI model.
Onde está
The HTML page preview feature in ChatGPT code blocks, specifically the permissions of the outer sandboxed preview iframe (allow-popups and allow-popups-to-escape-sandbox) and the window.open override in the sandbox scripts; no public code or commit is named.
Como foi descoberta
Check Point Research found the flaw; the research is credited to Alexey Bukhteyev, and Eli Smadja, head of research, commented on it. It was reported to OpenAI under responsible disclosure. OpenAI deployed a server-side fix on September 18, 2026 (one Check Point post says 'by' that date), and Check Point retested and confirmed the technique no longer works. Details were published on November 5, 2026. The articles do not say how the weakness was first spotted. A week earlier, Parameter Labs reported a separate ChatGPT sandbox and CSP bypass.
PoC existente, privada
O exploit existe, mas quem o tem não o publicou.
Check Point demonstrated the technique, including zero-click exfiltration of chat messages to an attacker-controlled server in ChatGPT Classic through a malicious GPT, and a fake update lure. The research shows only short snippets, and no article says a working exploit or tool was released, so it is treated as private. Since the fix is server-side, urgency for defenders is low. The residual risk is social engineering through popups and shared chats.
Explicação gerada por IA a partir da matéria e dos artigos, em 06/11/2026 06:17.
Detalhes técnicos
- OpenAI introduced HTML page preview for code blocks in February 2026. It renders user-controlled HTML/JS inside two nested sandboxed iframes, intended to isolate it from the ChatGPT application context, cookies and localStorage (research.checkpoint.com). System rules also restricted external network calls and unauthorized popup interactions (securityonline.info).
- The sandbox still had
allow-popupsandallow-popups-to-escape-sandboxenabled. These permissive tokens undermined the defenses by letting popups escape the sandbox (securityonline.info). The sandbox's redefinedwindow.openblocked direct popups pending user approval (research.checkpoint.com). - An attacker could create a nested iframe and call its own
contentWindow.open. This gave access to an unmodified popup function, and the resulting popups ran outside the sandbox because of the escape token (research.checkpoint.com, thehackernews.com). - The popups kept the legitimate ChatGPT app icon, while the attacker controlled the title and content. Images and links could be embedded for exfiltration and phishing lures (research.checkpoint.com, blog.checkpoint.com).
- Because the attacker controls the popup content, a convincing fake ChatGPT update could trick victims into clicking a link and downloading malware (thehackernews.com).
- In ChatGPT Classic,
window.opencould fire without a user gesture. The app also allowed window reloading and forced sign-outs, which redirected users to attacker-controlled phishing pages (research.checkpoint.com, blog.checkpoint.com). Simply having a conversation in the app triggered the leak (gbhackers.com). - The disclosure follows a separate report, a week earlier, by Parameter Labs on a ChatGPT sandbox/CSP bypass enabling account takeover via a shared link and a single HTML-preview click. It also follows an earlier Check Point finding of a covert cross-account command channel in ChatGPT's code-execution environments (thehackernews.com).
Remediação
- OpenAI removed the
allow-popupsandallow-popups-to-escape-sandboxpermissions from the outer HTML-preview sandbox iframe. The fix is server-side, so no patching is needed by users (research.checkpoint.com, thehackernews.com). - Users should stay aware of residual social-engineering risk from popups and shared chats (thehackernews.com).
- Check Point recommends that enterprises gain visibility into AI service usage and enforce policies limiting sensitive data shared with AI platforms. It also advises treating surrounding components (runtimes, connectors, sandboxes) as part of the AI attack surface and minimizing data exposure to reduce the impact of third-party AI platform vulnerabilities (blog.checkpoint.com).
Relatos divergentes
- Affected client naming: blog.checkpoint.com calls the most severe case the "ChatGPT desktop application", while research.checkpoint.com, thehackernews.com and gbhackers.com name it ChatGPT Classic. They appear to describe the same Electron-based app.
- Fix date: blog.checkpoint.com says the fix was deployed "by" September 18, 2026, while research.checkpoint.com and thehackernews.com say it was deployed on that date. securityonline.info gives only "September 2026", which is consistent with both. The more detailed research.checkpoint.com account is the more authoritative one.
Linha do tempo
-
ChatGPT Lockdown Mode Bypass Allowed Hackers to Steal Private Chats Without User Interaction
ler a análise desta fonte ocultar
Research found a flaw that bypassed ChatGPT’s Lockdown Mode. It let attackers silently exfiltrate full chat histories, deliver malware, and phish credentials from inside a trusted interface.
Researcher Alexey Bukhteyev published the findings on November 5, 2026. In the ChatGPT Classic desktop app, simply having a conversation triggered the leak.
-
ChatGPT Lockdown Mode Bypass Exposes Chat Data
ler a análise desta fonte ocultar
Cybersecurity firm Check Point Research recently uncovered a significant vulnerability within ChatGPT. Specifically, the flaw resides in the platform’s HTML page preview feature. This defect successfully circumvents OpenAI’s protective Lockdown Mode. Consequently, malicious actors could covertly exfiltrate confidential conversational records. Check Point promptly notified OpenAI regarding the weakness. Subsequently, OpenAI resolved the security loophole in September 2026 before public disclosures appeared.
ChatGPT natively allows subscribers to preview rendered HTML pages inside code blocks. To protect user privacy, the application isolates rendered content within nested iframe sandboxes. Furthermore, system rules actively restrict external network calls and unauthorized popup interactions. However, researchers discovered that permissive sandbox tokens undermined these defenses. Specifically, the configuration enabled tokens allowing popups to escape the sandbox environment.
-
Researchers Bypass OpenAI ChatGPT Lockdown Mode via HTML Preview Popup Sandbox Escape
ler a análise desta fonte ocultar
Check Point Research disclosed a now-patched vulnerability that allowed attackers to bypass Lockdown Mode, an optional OpenAI security setting introduced to reduce data-exfiltration risk from prompt injection, in ChatGPT. The flaw resided in the HTML page preview feature inside ChatGPT code blocks, which renders user-supplied HTML/JavaScript inside a sandboxed iframe that normally blocks access to cookies, local storage, and outbound network requests. By creating a nested iframe inside the sandboxed preview and invoking its own
window.openfunction, an attacker could obtain an unmodified popup mechanism that was not subject to the sandbox's restrictions, since the underlyingallow-popupsandallow-popups-to-escape-sandboxpermissions were still enabled. This allowed covert exfiltration of entire chat histories and uploaded files, credential-phishing lures, and malware delivery through a crafted prompt, a malicious GPT, or a shared chat link. In the Electron-based ChatGPT Classic desktop application,window.opencould be triggered without any user gesture, making the attack zero-click: simply having a conversation with a malicious GPT was enough to trigger silent exfiltration to an attacker-controlled server.Technical Details
The HTML preview sandbox uses two nested iframes; researchers found that the underlying sandbox permissions "still allowed popups and permitted them to escape the sandbox," and a nested frame let the attacker "access an unmodified popup function and bypass the restrictions." Because the attacker fully controls the popup content, it could be used to display convincing lures, such as a fake ChatGPT update, and trick the victim into downloading malware by persuading them to click on a link (thehackernews.com). In ChatGPT Classic, the Electron app also allowed window reloading and forced sign-outs to stage credential-phishing pages (research.checkpoint.com). This disclosure follows a separate week-earlier report by Parameter Labs on a ChatGPT sandbox/CSP bypass enabling account takeover via a shared link and a single HTML-preview click, and an earlier Check Point finding of a covert cross-account command channel in ChatGPT's code-execution environments.
Fix Details
On September 18, 2026, OpenAI informed Check Point that it had deployed a fix by removing the
allow-popupsandallow-popups-to-escape-sandboxpermissions from the outer HTML-preview sandbox iframe (research.checkpoint.com). Check Point retested the exploitation technique after the fix and confirmed it no longer worked (research.checkpoint.com). No CVE identifier has been assigned to this issue in the available sources.Remediation
The fix is already deployed server-side by OpenAI; no user action is required beyond ensuring awareness of residual social-engineering risk from popups and shared chats. The finding underscores that AI platform security controls, such as Lockdown Mode, depend on the integrity of surrounding application features (sandbox implementations, popup handling) and not solely on the model itself.
-
Check Point Finds ChatGPT Lockdown Mode Bypass Enabling Zero-Click Data Exfiltration, Phishing and Malware Delivery
ler a análise desta fonte ocultar
Check Point Research disclosed a vulnerability in ChatGPT's HTML-preview sandbox that allowed attackers to bypass Lockdown Mode, OpenAI's advanced setting meant to block prompt-injection-based data exfiltration. By nesting an additional iframe and invoking its
contentWindow.openfunction, an attacker could escape the sandbox restrictions (allow-popups,allow-popups-to-escape-sandbox) and open popups displaying arbitrary attacker-controlled content inside the trusted ChatGPT interface. The flaw enabled covert exfiltration of entire chat histories and uploaded files, phishing via spoofed application windows disguised as legitimate ChatGPT update prompts, and credential theft by forcing user sign-out and re-authentication on attacker-controlled pages. In the Electron-based ChatGPT Classic app, the exploit required zero user interaction, aswindow.opencould be triggered silently, merely having a conversation with a malicious GPT or shared chat was enough to trigger data exfiltration to an attacker server. The attack could be delivered through a malicious prompt, a malicious GPT, or a shared chat, and was demonstrated against both the browser and desktop clients.Technical Details
OpenAI introduced HTML page preview for code blocks in February 2026, rendering user-controlled HTML/JS inside two nested sandboxed iframes to isolate it from the ChatGPT application context, cookies, and localStorage. However, the sandbox left
allow-popupsandallow-popups-to-escape-sandboxenabled; while the sandbox's redefinedwindow.openblocked direct popups pending user approval, creating a nested iframe and calling its owncontentWindow.openbypassed this restriction entirely, since the inner iframe's popup windows execute outside the sandbox due to the escape token. This allowed attacker-controlled popups retaining the ChatGPT app icon with attacker-controlled titles and content, as well as image/link embedding for exfiltration and phishing lures.Remediation
Check Point Research responsibly disclosed the vulnerability to OpenAI, which deployed a fix on September 18, 2026 by removing the
allow-popupsandallow-popups-to-escape-sandboxpermissions from the outer HTML-preview sandbox iframe. Check Point confirmed the exploitation technique no longer works after retesting. -
ChatGPT Lockdown Mode Bypass Enabled Zero-Click Data Exfiltration, Phishing and Malware Lures
ler a análise desta fonte ocultar
Check Point Research (CPR) discovered and responsibly disclosed a vulnerability that bypassed ChatGPT Lockdown Mode, a security feature intended to limit prompt-injection-driven data exfiltration. The flaw resided in how HTML page previews inside ChatGPT code blocks handled nested sandboxed frames and popup windows, allowing an attacker to escape the sandbox restrictions meant to isolate rendered content. Exploitation scenarios included silent chat data exfiltration, credential phishing via spoofed authentication pages, and malware delivery disguised as a fake ChatGPT update, all presented within the trusted ChatGPT interface. The most severe case involved the Electron-based ChatGPT desktop application, where the popup abuse worked without user interaction, enabling zero-click exfiltration of conversation data via a malicious GPT. OpenAI deployed a fix by September 18, 2026, removing the sandbox permissions that enabled the technique, and CPR confirmed the bypass no longer works.
Technical Details
The bypass exploited nested sandboxed iframes within ChatGPT's HTML preview feature: while ChatGPT intercepted direct attempts to open new windows, underlying sandbox permissions still allowed popups to be spawned from a secondary nested frame, granting access to an unmodified popup function that escaped the original sandbox restrictions. In the desktop app, these popups retained the legitimate ChatGPT application icon while attacker-controlled title and content could be injected, and the main application window could be manipulated to forcibly sign users out, redirecting them to attacker-controlled phishing pages.
Remediation
OpenAI removed the sandbox permissions enabling the popup escape technique. Check Point recommends enterprises gain visibility into AI service usage, enforce policies limiting sensitive data shared with AI platforms, treat surrounding application components (runtimes, connectors, sandboxes) as part of the AI attack surface, and minimize data exposure to reduce impact from third-party AI platform vulnerabilities.