AnswersPublished19 sources
How a ChatGPT HTML Preview Bypassed Lockdown Mode
Check Point found that popup permissions in ChatGPT’s HTML preview sandbox could bypass Lockdown Mode, enabling silent chat data theft, phishing, and malware delivery. Lockdown Mode limits web and external service capabilities to reduce prompt injection risks, but the preview sandbox was a separate application featu...
Published byEdited with GPT-6 LunaImages generated with GPT Image 2
Research answer
Key takeaways
- Check Point found that popup permissions in ChatGPT’s HTML preview sandbox could bypass Lockdown Mode, enabling silent chat data theft, phishing, and malware delivery.
- Lockdown Mode limits web and external service capabilities to reduce prompt injection risks, but the preview sandbox was a separate application feature that those restrictions did not adequately protect.[9][10]
- The finding highlights a broader security lesson: protecting AI products requires securing the surrounding application and its handling of untrusted content, not just the model.[1][2]
AI Prompt
openai.comCreate a landscape editorial hero image for this Studio Global article: What did Check Point Research discover about the ChatGPT Lockdown Mode bypass that OpenAI patched on September 18, 2026, how did Lockdown Mo. Article summary: Check Point Research found an application-level weakness in ChatGPT’s HTML-preview sandbox that bypassed Lockdown Mode, enabling silent chat-data theft, phishing and malware delivery rather than defeating the model’s saf. Topic tags: general, general web. Style: premium digital editorial illustration, source-backed research mood, clean composition, high detail, modern web publication hero. Use reference image context only for broad subject, composition, and topical grounding; do not copy the exact image. Avoid: logos, brand marks, copyrighted characters, real person likenesses, fake screenshots, UI text, readable text, watermarks, charts with fake numbers, clic
Check Point Research found that ChatGPT’s HTML preview sandbox could be used to bypass Lockdown Mode. The researchers said the application-level flaw could enable silent chat-data exfiltration, phishing, and malware delivery. OpenAI fixed the issue after responsible disclosure, and Check Point confirmed that the reported technique no longer worked.1
2
What Lockdown Mode was designed to do
OpenAI’s June 4, 2026 update extended Lockdown Mode to personal and self-serve Business accounts. The optional setting is intended to reduce the risk of data exfiltration through prompt injection by limiting access to the web and external services. Depending on the feature, that can mean restricting or turning off capabilities such as live browsing, Deep Research, Agent Mode, connectors, and file downloads.10
13
The protection is aimed at limiting what ChatGPT and its connected tools can send out. Check Point’s finding involved a different part of the product: the feature that renders HTML previews from code blocks inside ChatGPT.2
18
How the HTML preview bypass worked
According to the reported technique, the HTML preview used nested sandboxed frames, but popup permissions remained available. The attack chain used a nested iframe and its contentWindow.open method to open a popup beyond the preview’s sandbox restrictions.12
18
That distinction matters: the researchers described a weakness in how ChatGPT’s application handled rendered content and popups, rather than a failure of the model to follow its safety instructions. Lockdown Mode’s restrictions on connected tools did not, by themselves, secure this separate preview pathway.1
2
Reported impact, including ChatGPT Classic
Check Point reported that the bypass could be used for silent theft of chat data, phishing, and malware delivery.2 In ChatGPT Classic, researchers said exploitation could require no user interaction beyond having a conversation with attacker-controlled content; the conversation could trigger silent data exfiltration.
2
“Zero interaction” in this context does not mean an attacker can reach an arbitrary account without any exposure to malicious content. It describes the reported behavior in ChatGPT Classic once the relevant attacker-controlled content was part of the conversation.2
The fix and what the sources establish
Reports say OpenAI removed the popup permissions that enabled the technique. Check Point said it retested and confirmed that the bypass no longer worked.1
7 A secondary report gives September 18, 2026, as the fix date.
20
The available reporting supports the core issue, its broad impact, and the confirmation that the technique stopped working. It does not establish every possible delivery scenario or justify treating all HTML previews as exploitable.
A separate share-link issue is a different vulnerability
Parameter Labs later reported a separate ChatGPT issue in which a public share link could run attacker-controlled JavaScript in a viewer’s authenticated ChatGPT session. The firm said OpenAI confirmed a fix on October 26.21 That report describes a distinct account-takeover chain; it is not evidence that the Check Point Lockdown Mode bypass remained open.
21
Together, the findings underline a practical security principle: safeguards around model behavior are only one layer. Rendered previews, sandbox permissions, session boundaries, and other application features also need to be secured when they handle untrusted content.1
2
21
Studio Global AI
Continue your research
This page includes a source-backed answer you can continue inside Studio Global.
People also ask
What is the short answer to "How a ChatGPT HTML Preview Bypassed Lockdown Mode"?
Check Point found that popup permissions in ChatGPT’s HTML preview sandbox could bypass Lockdown Mode, enabling silent chat data theft, phishing, and malware delivery.
What are the key points to validate first?
Check Point found that popup permissions in ChatGPT’s HTML preview sandbox could bypass Lockdown Mode, enabling silent chat data theft, phishing, and malware delivery. Lockdown Mode limits web and external service capabilities to reduce prompt injection risks, but the preview sandbox was a separate application feature that those restrictions did not adequately protect.[9][10]
What should I do next in practice?
The finding highlights a broader security lesson: protecting AI products requires securing the surrounding application and its handling of untrusted content, not just the model.[1][2]