ChatGPT Lockdown Mode Bypass Enabled Zero-Click Data Exfiltration, Phishing and Malware Lures
Check Point Research (CPR) discovered and responsibly disclosed a vulnerability that bypassed ChatGPT Lockdown Mode, a security feature intended to limit prompt-injection-driven data exfiltration. The flaw resided in how HTML page previews inside ChatGPT code blocks handled nested sandboxed frames and popup windows, allowing an attacker to escape the sandbox restrictions meant to isolate rendered content. Exploitation scenarios included silent chat data exfiltration, credential phishing via spoofed authentication pages, and malware delivery disguised as a fake ChatGPT update, all presented within the trusted ChatGPT interface. The most severe case involved the Electron-based ChatGPT desktop application, where the popup abuse worked without user interaction, enabling zero-click exfiltration of conversation data via a malicious GPT. OpenAI deployed a fix by September 18, 2026, removing the sandbox permissions that enabled the technique, and CPR confirmed the bypass no longer works.
Entenda a falha
A vulnerabilidade
A sandbox escape in ChatGPT's HTML page preview for code blocks bypassed Lockdown Mode, the optional setting meant to limit prompt-injection-driven data exfiltration. No CVE was assigned. The flaw affects ChatGPT, including the Electron-based desktop app. An attacker needs the victim to process malicious content such as a prompt, a malicious GPT or a shared chat. In the desktop app the popup worked without a user gesture, so chat data could leak with zero clicks. Attackers could also run phishing and fake-update malware lures inside the trusted interface. OpenAI fixed it by removing the sandbox permissions; the story gives September 18, 2026 as the fix date.
Como funciona
ChatGPT can render HTML from a code block in a preview placed inside a sandbox, which blocks access to cookies, local storage and the main interface and normally requires approval before opening external URLs. The preview uses nested sandboxed frames. ChatGPT intercepts direct attempts to open new windows. However, the sandbox permissions still allowed popups, and a further nested frame inside the rendered page gave access to an unmodified popup function. A window opened that way escaped the sandbox restrictions and Lockdown Mode's outbound controls. In the desktop app it kept the ChatGPT icon, with attacker-chosen title and content, and could sign the user out.
Por que é vulnerável
The root cause is an incomplete sandbox design. ChatGPT only intercepted the popup call in the top preview frame, while the sandbox attributes still granted popup permission to nested frames, where the original function remained reachable. The control was enforced at the wrong layer instead of by removing the permission. Check Point stresses that the weakness sat in the surrounding application environment, not in the model, which undermined an AI-specific safeguard. The fix removes the sandbox permissions that enabled the popup escape.
Como foi descoberta
Check Point Research found the flaw and reported it to OpenAI under responsible disclosure. OpenAI fixed it, and CPR confirmed the described technique no longer works. Check Point published its write-up on November 5, 2026. The articles give no details on how the research started or on the report date.
PoC existente, privada
O exploit existe, mas quem o tem não o publicou.
Check Point Research demonstrated the attack in the ChatGPT desktop app: a malicious GPT silently leaking chat messages to an attacker-controlled server during a conversation, plus a fake ChatGPT update lure for malware and a forced sign-out leading to a credential-phishing page. Downloading a file still required a click. The articles do not say a PoC was released, so it is treated as private. The bug is fixed, so the practical urgency is confirming ChatGPT clients are up to date.
Explicação gerada por IA a partir da matéria e dos artigos, em 05/11/2026 12:16.
Detalhes técnicos
The bypass exploited nested sandboxed iframes within ChatGPT's HTML preview feature: while ChatGPT intercepted direct attempts to open new windows, underlying sandbox permissions still allowed popups to be spawned from a secondary nested frame, granting access to an unmodified popup function that escaped the original sandbox restrictions. In the desktop app, these popups retained the legitimate ChatGPT application icon while attacker-controlled title and content could be injected, and the main application window could be manipulated to forcibly sign users out, redirecting them to attacker-controlled phishing pages.
Remediação
OpenAI removed the sandbox permissions enabling the popup escape technique. Check Point recommends enterprises gain visibility into AI service usage, enforce policies limiting sensitive data shared with AI platforms, treat surrounding application components (runtimes, connectors, sandboxes) as part of the AI attack surface, and minimize data exposure to reduce impact from third-party AI platform vulnerabilities.
Linha do tempo
-
ChatGPT Lockdown Mode Bypass Enabled Zero-Click Data Exfiltration, Phishing and Malware Lures
ler a análise desta fonte ocultar
Check Point Research (CPR) discovered and responsibly disclosed a vulnerability that bypassed ChatGPT Lockdown Mode, a security feature intended to limit prompt-injection-driven data exfiltration. The flaw resided in how HTML page previews inside ChatGPT code blocks handled nested sandboxed frames and popup windows, allowing an attacker to escape the sandbox restrictions meant to isolate rendered content. Exploitation scenarios included silent chat data exfiltration, credential phishing via spoofed authentication pages, and malware delivery disguised as a fake ChatGPT update, all presented within the trusted ChatGPT interface. The most severe case involved the Electron-based ChatGPT desktop application, where the popup abuse worked without user interaction, enabling zero-click exfiltration of conversation data via a malicious GPT. OpenAI deployed a fix by September 18, 2026, removing the sandbox permissions that enabled the technique, and CPR confirmed the bypass no longer works.
Technical Details
The bypass exploited nested sandboxed iframes within ChatGPT's HTML preview feature: while ChatGPT intercepted direct attempts to open new windows, underlying sandbox permissions still allowed popups to be spawned from a secondary nested frame, granting access to an unmodified popup function that escaped the original sandbox restrictions. In the desktop app, these popups retained the legitimate ChatGPT application icon while attacker-controlled title and content could be injected, and the main application window could be manipulated to forcibly sign users out, redirecting them to attacker-controlled phishing pages.
Remediation
OpenAI removed the sandbox permissions enabling the popup escape technique. Check Point recommends enterprises gain visibility into AI service usage, enforce policies limiting sensitive data shared with AI platforms, treat surrounding application components (runtimes, connectors, sandboxes) as part of the AI attack surface, and minimize data exposure to reduce impact from third-party AI platform vulnerabilities.