ChatGPT Lockdown Mode bypassed via HTML preview sandbox escape

Cybersecurity researchers at Check Point have disclosed a critical vulnerability in OpenAI’s ChatGPT that allowed attackers to bypass the application’s Lockdown Mode protections. The flaw, which was present in the desktop application, enabled silent data exfiltration and malware delivery without requiring any direct interaction from the victim. OpenAI addressed the issue with a patch released on September 18, 2026.

What happened

Lockdown Mode was introduced by OpenAI in June 2026 as an optional security setting designed to minimize the risk of data exfiltration caused by prompt injections. It acts as a barrier by limiting outbound network requests, preventing sensitive information from being transferred to attacker-controlled infrastructure. However, Check Point researchers discovered a loophole in how the application handles HTML page previews within code blocks, effectively neutralizing these protections.

The vulnerability stems from the way ChatGPT renders HTML content inside its interface. While the application places this content in a sandbox to prevent it from accessing cookies or local storage, the implementation contained a weakness regarding popup windows. By exploiting nested sandboxed frames, an attacker could escape the sandbox restrictions. This escape route allowed malicious content to bypass Lockdown Mode entirely, enabling the theft of chat messages and the delivery of malware through crafted prompts or shared chats.

This disclosure follows a series of related security findings in the AI ecosystem. Just a week prior, Parameter Labs revealed a method to bypass ChatGPT’s sandbox and content security policy by sending a malicious share link. Additionally, Check Point had previously demonstrated a covert cross-account command channel that allowed attackers to run hidden tasks using a victim’s session. These incidents highlight a growing pattern where weaknesses in the surrounding application environment undermine AI-specific security controls.

How it works

The core of the vulnerability lies in the handling of HTML previews. When ChatGPT renders user-supplied HTML, it uses nested sandboxed frames to isolate the content. The application intercepts direct attempts to open new windows from these frames to maintain security. However, the underlying sandbox permissions still allowed popups to be created. Researchers found that by creating another nested frame within the rendered page, they could access an unmodified popup function.

This technique allowed the attacker to bypass the restrictions placed on the original HTML preview. Content opened through this new route was no longer subject to the same sandbox limitations, providing a direct path around Lockdown Mode. Once the restrictions were lifted, the attacker gained complete control over the content displayed in the popup window. This could be used to render convincing social-engineering lures, such as fake update notifications, tricking users into downloading malware or revealing credentials.

Key details

• The vulnerability allowed for zero-click data exfiltration in the ChatGPT desktop application.
• Lockdown Mode, introduced in June 2026, was bypassed due to a flaw in HTML preview handling.
• The exploit utilized nested sandboxed frames to access an unmodified popup function.
• OpenAI patched the vulnerability on September 18, 2026, following responsible disclosure.
• Attackers could use the flaw to deliver malware via fake ChatGPT update lures.
• The issue highlights that AI security controls are dependent on the wider application environment.

Why it matters

For developers and engineering leads building products with AI, this incident serves as a stark reminder that model-level safety is not enough. Security controls like Lockdown Mode are only as strong as the application layer that surrounds them. Weaknesses in standard web technologies, such as HTML rendering and sandbox management, can create side channels that bypass sophisticated AI safeguards. This means that securing an AI product requires rigorous attention to traditional application security practices, including input validation and sandbox integrity.

The broader implication is that AI agents and assistants are becoming complex software environments with their own attack surfaces. As seen with other recent vulnerabilities like SkillJacking and Embrace, attackers are increasingly targeting the integration points between AI models and external tools. Teams must assume that prompt injection is a persistent threat and design their systems to fail safely when unexpected inputs occur. Relying solely on the AI provider’s security features without auditing the host application’s behavior is a significant risk.

What you can do

• Ensure your ChatGPT desktop application is updated to the latest version post-September 18, 2026.
• Treat all HTML previews and shared chat links from untrusted sources as potentially malicious.
• Audit your own AI applications for similar sandbox escape vectors in HTML rendering components.
• Implement strict content security policies (CSP) to limit outbound requests from embedded content.
• Monitor for unusual outbound network traffic from AI agent environments as a sign of exfiltration.
• Educate users about the risks of clicking links or downloading files from AI-generated previews.