OpenAI ChatGPT Lockdown Mode bypass allows zero-click chat exfiltration and phishing
TL;DR
OpenAI ChatGPT's Lockdown Mode can be bypassed via a flaw in how the desktop application handles HTML page previews. This vulnerability allows for zero-click data exfiltration, phishing, or malware delivery. Users of the ChatGPT desktop application should update to the latest version immediately.
What happened
Researchers at Check Point discovered a loophole in ChatGPT's HTML preview mechanism that circumvents the security boundaries of Lockdown Mode. While Lockdown Mode was designed to prevent data exfiltration by sandboxing HTML content and limiting outbound network requests, the flaw allowed attackers to escape this sandbox.
The vulnerability exists because of how the application handles nested frames and popup windows. By creating a nested frame within a rendered page, an attacker could access an unmodified popup function. This allowed the content to bypass the restrictions placed on the original HTML preview. Attackers could trigger this bypass using crafted prompts, malicious GPTs, or shared chat links to steal chat data or deliver malicious payloads. OpenAI patched the vulnerability on September 18, 2026.
Why it matters
This is a high-impact flaw because it enables zero-click attacks. An attacker does not need a user to execute code; they only need the user to interact with a shared chat or a malicious GPT that triggers the HTML preview. Because the sandbox escape allows the content to move outside of the restricted environment, it provides a direct path for stealing sensitive chat history or tricking users into downloading malware via convincing social-engineering lures, such as fake ChatGPT updates. This highlights that AI security controls are only as effective as the wider application environment surrounding them.
Who is affected
- OpenAI ChatGPT desktop application (Electron-based environment)
What to do now
- Update the ChatGPT desktop application to the latest version.
- Exercise caution when opening shared chat links that may trigger HTML previews.
- Watch for unexpected popup windows appearing during chat interactions.
What we don't know yet
- The specific version numbers of the desktop application that were vulnerable prior to the patch.
- Whether this specific bypass was exploited in the wild before its disclosure.
Sources
