Confirmed 5 Nov 2026 · Security A one-minute read
ChatGPT's Lockdown Mode could be bypassed to send an entire chat history away silently.
Check Point Research published the bypass on November 5. Caveat: OpenAI removed the two sandbox permissions behind it on September 18, and Check Point confirmed the technique no longer works.
A mode that blocks network access blocks your data from leaving.
Each new rendering surface reopens the question the mode had settled.
Why it matters
The mode was not broken by an attack on the mode. It was broken by a convenience feature shipped into it 9 months ago, carrying 2 permission tokens nobody rechecked. Every assistant is adding rendering surfaces now, and each one can hand back the capability a security setting removed.
Established
- The outer preview iframe kept allow-popups and allow-popups-to-escape-sandbox enabled.
- In ChatGPT Classic the exfiltration required no user interaction.
- OpenAI said on September 18 that it had removed both tokens.
Not established
- That anyone exploited it. Check Point reports no use in the wild.
- Which versions were affected. The post names no version numbers.
- That other rendering surfaces are safe. Only this one was tested.
The five-minute readThe record, the timeline, the weight and 1 source
The record
The post is ChatGPT Lockdown Mode Bypass: Phishing, Malware Delivery, and Silent Data Exfiltration, published Thursday November 5, 2026 at 14:00 UTC by Alexey Bukhteyev for Check Point Research. We read it at research.checkpoint.com. Lockdown Mode is an optional setting for logged-in users that restricts live web access to cached content, blocks internet images, disables network requests from code generated in Canvas, and turns off Deep Research, Agent Mode, live connectors and file downloads. In February 2026 OpenAI added an HTML page preview for ChatGPT code blocks, which renders user-controlled HTML and JavaScript inside 2 nested iframes. The sandbox intercepts outbound requests, remote images, scripts and links, and shows approval dialogs instead. It also redefines window.open, so calls to a real URL require approval while calls with an empty URL or about:blank return null silently, with no notification. The flaw: the outer iframe kept the allow-popups and allow-popups-to-escape-sandbox tokens enabled. A page could create a nested iframe and call open on that iframe's own contentWindow, reaching the real function, and content opened in the resulting popup no longer ran inside the sandbox. Check Point demonstrated 4 attacks on video: sending an entire chat history to a third-party server with no notification; malware delivery through a spoofed ChatGPT window; malware delivery through a shared chat; and credential theft by signing the user out and reloading the main window to phish the login. In the Electron-based ChatGPT Classic desktop application the post states the attack requires zero user interaction, because window.open works without a user gesture; malware delivery there still needs a click, since the application blocks automatic downloads. In a browser automatic downloads are not blocked and the victim does not need an account, so clicking content in a shared chat is enough. Delivery routes named: a malicious prompt, a malicious GPT, or a shared chat. Uploaded files were also at risk. On September 18, 2026 OpenAI told Check Point it had deployed a fix by removing both tokens from the outer preview iframe. Check Point's conclusion: guardrails and built-in security features still offer no absolute guarantee of protection. Not established: the disclosure date, affected version numbers, and whether anyone used it.
How it got here
- Feb 2026
OpenAI adds an HTML page preview for ChatGPT code blocks, rendering user-controlled HTML and JavaScript in nested iframes. The outer one keeps 2 popup tokens.
- 2026
Check Point discloses a separate flaw in ChatGPT's code-execution runtime, letting data leave by domain name system tunnelling. OpenAI fixes it promptly.
- Oct 2
ChatGPT's free tier in the United States gains access to bank accounts and credit files. Edition 041. The material a locked-down session now holds.
- Sep 18
OpenAI tells Check Point it has deployed a fix, removing allow-popups and allow-popups-to-escape-sandbox from the outer preview iframe.
- Nov 5
Check Point publishes the bypass with 4 demonstration videos, 48 days after the fix and 2 days after raising its own bug bounty was carded.
OpenAI, which shipped the preview and the mode; every user who enabled Lockdown Mode between February and September and believed it held; the authors of malicious GPTs and shared chats, now holding a published technique; Anthropic, Google and Meta, all adding rendering surfaces to their own assistants; the state attorneys general already investigating OpenAI's data handling.
What to watch
- Would strengthen itA second published bypass of a major assistant's security or lockdown mode traces to a rendering, preview or canvas surface added after the mode shipped, by June 30, 2027.
- Would weaken itOpenAI publishes a review of every rendering surface inside Lockdown Mode, or no comparable bypass of any assistant lockdown mode is published, by December 31, 2027.
- Would strengthen itOpenAI or Check Point confirms the tokens were a configuration error rather than an intended usability setting, by March 31, 2027.
Why it weighs this much
Cost is low. Finding and writing up 2 misplaced sandbox tokens is a few researcher-weeks, and Check Point publishes this work to be seen. Commitment is medium: a named researcher, 4 demonstration videos and a vendor timeline are a reputational stake Check Point cannot quietly withdraw, and OpenAI confirming the fix puts the vendor on the record too. Reversibility is easy in both directions. The fix was 2 tokens removed, and the same class of mistake can return with the next preview surface. Persistence is a month, scored honestly: the specific hole is closed, and what lasts is the pattern rather than this instance. We card it because the mode's whole purpose is to be trusted.
The words
- Lockdown Mode
- An optional ChatGPT setting that cuts live web access, images, downloads and connectors. Users turn it on when they are handling material they do not want leaving the session.
- iframe sandbox
- A browser restriction on embedded content. Permissions are granted by named tokens, and a token left on by mistake can undo the rest of the restriction.
- allow-popups-to-escape-sandbox
- A token letting a popup opened from sandboxed content run outside the sandbox. Combined with allow-popups it gave the preview a route out.
- Exfiltration
- Moving data out of a system to somewhere the attacker controls. Silent exfiltration leaves the user no notification and no dialog to refuse.
Sources
Your call
Which explanation do you believe?
A call is final. Other people's calls show after yours.