Researchers Bypass OpenAI ChatGPT Lockdown Mode via HTML Preview Popup Sandbox Escape
Check Point Research disclosed a now-patched vulnerability that allowed attackers to bypass Lockdown Mode, an optional OpenAI security setting introduced to reduce data-exfiltration risk from prompt injection, in ChatGPT. The flaw resided in the HTML page preview feature inside ChatGPT code blocks, which renders user-supplied HTML/JavaScript inside a sandboxed iframe that normally blocks access to cookies, local storage, and outbound network requests. By creating a nested iframe inside the sandboxed preview and invoking its own window.open function, an attacker could obtain an unmodified popup mechanism that was not subject to the sandbox's restrictions, since the underlying allow-popups and allow-popups-to-escape-sandbox permissions were still enabled. This allowed covert exfiltration of entire chat histories and uploaded files, credential-phishing lures, and malware delivery through a crafted prompt, a malicious GPT, or a shared chat link. In the Electron-based ChatGPT Classic desktop application, window.open could be triggered without any user gesture, making the attack zero-click: simply having a conversation with a malicious GPT was enough to trigger silent exfiltration to an attacker-controlled server.
Entenda a falha
A vulnerabilidade
This is a sandbox escape in the HTML page preview for code blocks in OpenAI ChatGPT. It lets an attacker bypass Lockdown Mode, the optional setting meant to limit data exfiltration from prompt injection. The attacker only needs the victim to see attacker-controlled content, delivered through a crafted prompt, a malicious GPT or a shared chat link. The result is covert theft of chat histories and uploaded files, phishing lures and malware delivery. In the Electron-based ChatGPT Classic desktop app it is zero-click, because window.open fires without a user gesture. No CVE was assigned. OpenAI fixed it server-side, so there are no affected or fixed version numbers.
Como funciona
ChatGPT renders user-supplied HTML and JavaScript from a code block inside a sandboxed iframe. The sandbox blocks access to cookies and local storage and blocks outbound requests, and ChatGPT intercepts direct attempts to open new windows. The preview actually uses two nested iframes, and the sandbox permissions still allowed popups and allowed them to escape the sandbox. If the page creates another nested frame, it can reach an unmodified popup function that ChatGPT did not intercept. Content opened that way is no longer bound by the sandbox restrictions or by Lockdown Mode, so it can send data out or show arbitrary pages.
Por que é vulnerável
The cause is a sandbox misconfiguration. The outer preview iframe kept the allow-popups and allow-popups-to-escape-sandbox permissions, while protection relied on ChatGPT intercepting window.open in the first frame. That interception did not cover a fresh nested frame, which exposed the native popup function. Lockdown Mode depended on the integrity of this surrounding feature. The fix removed both permissions from the outer HTML-preview sandbox iframe.
Onde está
The HTML page preview feature in ChatGPT code blocks, specifically the permissions of the outer sandboxed preview iframe (allow-popups and allow-popups-to-escape-sandbox); no public code or commit is named.
Como foi descoberta
Check Point Research found the flaw and reported it to OpenAI under responsible disclosure. Eli Smadja, head of research at Check Point, described it. OpenAI told Check Point on September 18, 2026 that it had deployed a fix, and Check Point retested and confirmed the technique no longer worked. Details were published around November 5, 2026. The articles do not say how the weakness was first spotted. Separately, Parameter Labs reported a related ChatGPT sandbox and CSP bypass a week earlier.
PoC existente, privada
O exploit existe, mas quem o tem não o publicou.
Check Point demonstrated the technique, including zero-click exfiltration to an attacker-controlled server in ChatGPT Classic just by talking to a malicious GPT, and retested it after the fix. The articles do not say that exploit code was published, so it is treated as private and held by the researchers. Since the fix is deployed server-side, there is little urgency for defenders; the residual risk is social-engineering popups and shared chats.
Explicação gerada por IA a partir da matéria e dos artigos, em 05/11/2026 20:17.
Detalhes técnicos
The HTML preview sandbox uses two nested iframes; researchers found that the underlying sandbox permissions "still allowed popups and permitted them to escape the sandbox," and a nested frame let the attacker "access an unmodified popup function and bypass the restrictions." Because the attacker fully controls the popup content, it could be used to display convincing lures, such as a fake ChatGPT update, and trick the victim into downloading malware by persuading them to click on a link (thehackernews.com). In ChatGPT Classic, the Electron app also allowed window reloading and forced sign-outs to stage credential-phishing pages (research.checkpoint.com). This disclosure follows a separate week-earlier report by Parameter Labs on a ChatGPT sandbox/CSP bypass enabling account takeover via a shared link and a single HTML-preview click, and an earlier Check Point finding of a covert cross-account command channel in ChatGPT's code-execution environments.
Detalhes da correção
On September 18, 2026, OpenAI informed Check Point that it had deployed a fix by removing the allow-popups and allow-popups-to-escape-sandbox permissions from the outer HTML-preview sandbox iframe (research.checkpoint.com). Check Point retested the exploitation technique after the fix and confirmed it no longer worked (research.checkpoint.com). No CVE identifier has been assigned to this issue in the available sources.
Remediação
The fix is already deployed server-side by OpenAI; no user action is required beyond ensuring awareness of residual social-engineering risk from popups and shared chats. The finding underscores that AI platform security controls, such as Lockdown Mode, depend on the integrity of surrounding application features (sandbox implementations, popup handling) and not solely on the model itself.
Linha do tempo
-
Researchers Bypass OpenAI ChatGPT Lockdown Mode via HTML Preview Popup Sandbox Escape
ler a análise desta fonte ocultar
Check Point Research disclosed a now-patched vulnerability that allowed attackers to bypass Lockdown Mode, an optional OpenAI security setting introduced to reduce data-exfiltration risk from prompt injection, in ChatGPT. The flaw resided in the HTML page preview feature inside ChatGPT code blocks, which renders user-supplied HTML/JavaScript inside a sandboxed iframe that normally blocks access to cookies, local storage, and outbound network requests. By creating a nested iframe inside the sandboxed preview and invoking its own
window.openfunction, an attacker could obtain an unmodified popup mechanism that was not subject to the sandbox's restrictions, since the underlyingallow-popupsandallow-popups-to-escape-sandboxpermissions were still enabled. This allowed covert exfiltration of entire chat histories and uploaded files, credential-phishing lures, and malware delivery through a crafted prompt, a malicious GPT, or a shared chat link. In the Electron-based ChatGPT Classic desktop application,window.opencould be triggered without any user gesture, making the attack zero-click: simply having a conversation with a malicious GPT was enough to trigger silent exfiltration to an attacker-controlled server.Technical Details
The HTML preview sandbox uses two nested iframes; researchers found that the underlying sandbox permissions "still allowed popups and permitted them to escape the sandbox," and a nested frame let the attacker "access an unmodified popup function and bypass the restrictions." Because the attacker fully controls the popup content, it could be used to display convincing lures, such as a fake ChatGPT update, and trick the victim into downloading malware by persuading them to click on a link (thehackernews.com). In ChatGPT Classic, the Electron app also allowed window reloading and forced sign-outs to stage credential-phishing pages (research.checkpoint.com). This disclosure follows a separate week-earlier report by Parameter Labs on a ChatGPT sandbox/CSP bypass enabling account takeover via a shared link and a single HTML-preview click, and an earlier Check Point finding of a covert cross-account command channel in ChatGPT's code-execution environments.
Fix Details
On September 18, 2026, OpenAI informed Check Point that it had deployed a fix by removing the
allow-popupsandallow-popups-to-escape-sandboxpermissions from the outer HTML-preview sandbox iframe (research.checkpoint.com). Check Point retested the exploitation technique after the fix and confirmed it no longer worked (research.checkpoint.com). No CVE identifier has been assigned to this issue in the available sources.Remediation
The fix is already deployed server-side by OpenAI; no user action is required beyond ensuring awareness of residual social-engineering risk from popups and shared chats. The finding underscores that AI platform security controls, such as Lockdown Mode, depend on the integrity of surrounding application features (sandbox implementations, popup handling) and not solely on the model itself.