A setting meant to stop ChatGPT from leaking private chats could itself be bypassed. Check Point Research says attackers could copy a full conversation history, push phishing windows, and in the desktop app do it with no click from the victim. OpenAI closed the hole on 18 September after a private report; Check Point published the details on 5 November.
In its technical write-up, Check Point Research describes Lockdown Mode as an optional ChatGPT security switch. When it is on, live web access is limited to cached pages, image loading from the open internet is blocked, and tools such as Deep Research, Agent Mode, live connectors and file downloads are turned off. The point is to cut the routes a prompt-injection attack uses to send data out.
Where the hole sat
The flaw was not in the model’s answers. It sat in how ChatGPT renders HTML page previews inside code blocks. Those previews run in a sandbox so they cannot read cookies or talk to the wider web without approval. Check Point found that nested preview frames still allowed popup windows to escape that sandbox, which also slipped past Lockdown Mode.
Once outside the sandbox, a crafted prompt, a malicious custom GPT, or a shared chat could open attacker-controlled windows. Check Point says that path could copy chat history to a third-party server, show fake update screens, or push malware downloads. On the Electron-based ChatGPT Classic desktop app, researchers say the leak needed no user click — starting a conversation with a malicious GPT was enough.
Fixed, but not forgotten
OpenAI told Check Point on 18 September 2026 that it had removed the popup permissions from the outer HTML-preview frame. Check Point retested and confirmed the technique no longer works. The fix is server-side, so users do not need a desktop update.
The disclosure lands beside other ChatGPT client risks DailyAI has covered, from a shared-link hole that could expose private chats to OpenAI’s raised bug-bounty payouts. Eli Smadja, Check Point’s head of research, put the lesson simply: AI security controls are only as strong as the application around them.
Why it matters
Lockdown Mode was sold as a belt-and-braces switch for sensitive chats. A gap in the HTML preview layer meant that belt failed until September — and the report is a reminder that turning a safety toggle on is not the same as end-to-end protection of what you type.
Get AI to do the boring stuff
Our free AI agent playbook: simple, step-by-step recipes anyone can follow. Plus one short email a day with the AI story that matters.
