ChatGPT flaw let hackers steal private chats despite Lockdown Mode

What's going on

ChatGPT's Lockdown Mode is supposed to stop confidential data from leaking out of a conversation, even if an attacker has manipulated the AI. That exact protection could be bypassed. That's the finding of a study by Israeli security firm Check Point Research, published by researcher Alexey Bukhteyev on November 5, 2026. Using a popup trick, attackers could grab entire chat histories, slip in malware and phish login credentials. In the desktop app ChatGPT Classic, simply chatting as usual was enough. No click required.

The good news: Check Point reported the flaw to OpenAI privately ahead of time, and OpenAI fixed it on September 18, 2026. So you don't need to do anything. But the story shows how vulnerable AI platforms are in places hardly anyone thinks about.

What Lockdown Mode is supposed to do

The feature is designed to counter prompt injection. In this kind of attack, attackers hide instructions in content the AI processes, such as a web page, a document or a shared chat. The AI then follows those instructions as if they came from the user. A common goal is exfiltration, meaning secretly sneaking data out. One well-known trick: the AI is made to open a link like attacker.example/collect?data= with private information appended. The data ends up in the attacker's server logs while the chat looks completely normal.

That's why Lockdown Mode shuts as many exits as possible. Browsing is limited to cached pages, and images from the web are blocked. Deep Research, Agent Mode, Canvas's network features, live connectors to other services and file downloads are all turned off. According to cybersecuritynews.com, the feature launched on February 13, 2026, initially for business customers. Since June 4, it's also available for personal accounts and can be turned on under Settings > Security. Other sources only give June as the launch date. OpenAI itself describes the mode as an option for especially at-risk users like executives and security teams, and says most people don't need it.

The trick: a window in a window in a window

In February 2026, OpenAI introduced an HTML preview for code blocks. If ChatGPT generates a web page, you can view it right in the chat. Because this runs untrusted HTML and JavaScript, OpenAI locked the preview inside two nested iframes. These are mini web pages embedded within a page. This sandbox, an isolated area for unsafe code, was meant to block access to cookies, local storage and the actual ChatGPT interface. External requests, images, links and popups were intercepted, each triggering a confirmation dialog first.

The weakness was in the permissions. The outer iframe allowed both allow-popups and allow-popups-to-escape-sandbox. So popups were allowed to open and didn't have to follow the sandbox rules. To compensate, OpenAI replaced the window.open function, which web pages use to open new windows, with its own version that asks for permission first. But that replacement only applied at the top level. The code could simply create another iframe and call its unmodified window.open function. The result: a real popup running arbitrary code outside the sandbox, even with Lockdown Mode turned on.

"By creating an additional nested frame inside the rendered page, it was possible to reach an unmodified popup function and bypass the restrictions of the original HTML preview," Check Point research head Eli Smadja told The Hacker News.

Three attack scenarios

1. Fake updates with malware: In the desktop app, the popup kept the ChatGPT icon, while the attacker controlled the title. That made it easy to offer a convincing "ChatGPT update" that was actually malware. In the desktop app, the victim still had to click the download link. In the browser, downloads aren't blocked. There, a shared chat link was enough, and the victim didn't even need a ChatGPT account.

2. Data theft without a click: The most serious case involved ChatGPT Classic, which is built on the Electron framework. Electron lets developers build desktop programs from web technology. Here, window.open worked without any user action at all. A crafted prompt, a malicious custom GPT or a shared chat could quietly send the entire conversation history, including uploaded files, to an outside server mid-conversation. Check Point demonstrated this with a manipulated GPT. According to Check Point, the technique isn't fundamentally limited to the desktop app.

3. Phishing after a forced logout: The researchers could also reload the main window and log the user out. A fake login page could then have captured the password when the user signed back in.

Part of a whole series

This flaw is the latest in a string of findings. In March, Check Point showed that chat data could be smuggled out of ChatGPT's code execution environment via DNS tunneling, which hides data inside seemingly harmless address lookups. In September, the company demonstrated a covert command channel across accounts: a victim got a normal answer while an attacker's task ran in the background using the tools and data from the victim's session. According to The Hacker News, Parameter Labs described another flaw in the same HTML preview just a week before the latest disclosure. That one even allowed taking over someone else's account via a public share link. Check Point stresses that these are two different vulnerabilities in the same component, adding:

"This shows that every new feature is an opportunity for new vulnerabilities."

The Hacker News also lists a number of similar attacks on other AI tools in recent months, from built-in browsers in coding assistants like Cursor, GitHub Copilot and Claude Desktop to agent frameworks like LangGraph and CrewAI.

What you can do

For this specific flaw, you don't need to do anything. It's been fixed. But security experts quoted by cybersecuritynews.com recommend a few habits to guard against similar attacks:

• Don't click buttons, previews or "update" prompts in shared chats.
• Don't copy prompts from unknown websites, and don't use custom GPTs from unknown creators.
• After an unexpected logout, check carefully that the login page is genuine.
• Keep the desktop app up to date.
• Only enter medical, financial or work secrets when you really have to.

Our take

What makes this finding especially awkward is that it hits the very feature meant to protect cautious users. The real problem wasn't the language model. It was the application around it: browser technology, sandbox rules and the desktop runtime. Check Point sums it up this way: AI security controls are only as strong as the environment they run in. AI assistants have long since become full-fledged execution environments that run code in the cloud, render content on your device and handle sensitive data along the way. Every convenience feature expands the attack surface.

On the plus side, this was responsible disclosure: OpenAI responded, and Check Point only published after the fix. The sources contain no indication that the flaw was actually exploited, and the reports don't include a statement from OpenAI. Japanese site TapAI sums up the lesson nicely: protective modes lower the risk, but they don't guarantee security. OpenAI admits as much itself.