OpenAI’s Lockdown Mode was supposed to be the extra-strict setting that stops prompt-injection exfiltration. Check Point Research found a way around it. In a paper published in early November 2026, the researchers say a vulnerability let attackers bypass Lockdown Mode and “perform covert exfiltration of chat data to an external server,” as well as phishing and malware delivery. In ChatGPT Classic, they write, “simply having a conversation is enough to trigger silent data exfiltration.”
Quick Take
- What broke: Lockdown Mode, an optional ChatGPT setting meant to protect sensitive chats from prompt-injection exfiltration, could be bypassed.
- Impact: Silent theft of chat history, credential phishing, and malware delivery. The Hacker News quotes Check Point’s Eli Smadja saying the flaw included “zero-click data exfiltration in the ChatGPT desktop application.”
- How: After disclosure, OpenAI told Check Point on September 18, 2026 that it had deployed a fix by removing the
allow-popupsandallow-popups-to-escape-sandboxpermissions from the outer HTML-preview sandbox iframe. - Status: Check Point retested and says the technique no longer works. The public write-up arrived weeks after the fix.
What happened
Lockdown Mode was sold as a hardening switch: turn it on, and prompt-injection tricks that leak a conversation to an attacker’s server should fail. Check Point found that a popup could escape the HTML preview sandbox, taking those protections with it. Once the sandbox was bypassed, a crafted prompt, a malicious GPT, or a shared chat could be used to pull data out, or to push a phishing or malware payload.
The researchers say they disclosed the issue to OpenAI, which fixed the iframe permissions on September 18. That is a narrow, concrete change: popups were no longer allowed to leave the sandbox. Check Point confirmed the old technique stopped working after the change.
The Hacker News covered the research in November, after the fix was already in production. There has been no public statement from OpenAI or Check Point that this specific bypass was used in the wild before it was closed.
What you should do
- No customer patch is required; the fix was deployed by OpenAI on September 18, 2026.
- If you turned on Lockdown Mode because you handle sensitive data in ChatGPT, keep using it — the point of the research is that the mode was bypassed, then repaired, not that the mode is useless.
- Treat older shared chats and untrusted GPTs from before mid-September with the usual caution. This report does not, by itself, prove that any particular chat was stolen.
What it means
Lockdown Mode is only as strong as the browser sandbox around HTML preview. A permission flag on an iframe should not have been enough to unwind a setting that enterprises were encouraged to treat as a serious control. The useful outcome is that OpenAI removed the dangerous permissions and the researchers waited to publish until after the fix.
This bug is separate from the October ChatGPT share-link sandbox escape reported by Parameter, which i10x also covers: two different preview-and-share problems, both now patched.
About the analysis
Researched and written with AI assistance under the editorial responsibility of the i10X News team. The title image is an AI-generated illustration. Read our AI Use Policy. Spotted an error? Request a correction.
This i10x report is based on Check Point Research’s November write-up and The Hacker News’ November 2026 coverage. i10x did not reproduce the bypass.
