{"schema":"sanctity-signal/0.2","record_type":"signal","id":"checkpoint-lockdown-bypass-e075","domain":"security","drop_id":"signal-e075","occurred_at":"2026-11-05","how_to_use":"This is a structured record of one real-world action and its competing interpretations, from Sanctity Signal. To build content from it (a reel script, a blog, a thread): open on the hook, ground the viewer with plain and observed, walk the dated trail, present the interpretations as live tension between named readings, and close on the before/after shift and what_to_watch. Hard rules: items under established are fact; items under unknown are never presented as fact; the evidence status (verified or reported) is stated, not dropped; sources are cited.","actor":"Check Point Research","action_type":"publication of a bypass of ChatGPT's Lockdown Mode that allowed silent exfiltration of a user's entire chat history, with no user interaction in the ChatGPT Classic desktop application","observed":"The post is ChatGPT Lockdown Mode Bypass: Phishing, Malware Delivery, and Silent Data Exfiltration, published Thursday November 5, 2026 at 14:00 UTC by Alexey Bukhteyev for Check Point Research. We read it at research.checkpoint.com. Lockdown Mode is an optional setting for logged-in users that restricts live web access to cached content, blocks internet images, disables network requests from code generated in Canvas, and turns off Deep Research, Agent Mode, live connectors and file downloads. In February 2026 OpenAI added an HTML page preview for ChatGPT code blocks, which renders user-controlled HTML and JavaScript inside 2 nested iframes. The sandbox intercepts outbound requests, remote images, scripts and links, and shows approval dialogs instead. It also redefines window.open, so calls to a real URL require approval while calls with an empty URL or about:blank return null silently, with no notification. The flaw: the outer iframe kept the allow-popups and allow-popups-to-escape-sandbox tokens enabled. A page could create a nested iframe and call open on that iframe's own contentWindow, reaching the real function, and content opened in the resulting popup no longer ran inside the sandbox. Check Point demonstrated 4 attacks on video: sending an entire chat history to a third-party server with no notification; malware delivery through a spoofed ChatGPT window; malware delivery through a shared chat; and credential theft by signing the user out and reloading the main window to phish the login. In the Electron-based ChatGPT Classic desktop application the post states the attack requires zero user interaction, because window.open works without a user gesture; malware delivery there still needs a click, since the application blocks automatic downloads. In a browser automatic downloads are not blocked and the victim does not need an account, so clicking content in a shared chat is enough. Delivery routes named: a malicious prompt, a malicious GPT, or a shared chat. Uploaded files were also at risk. On September 18, 2026 OpenAI told Check Point it had deployed a fix by removing both tokens from the outer preview iframe. Check Point's conclusion: guardrails and built-in security features still offer no absolute guarantee of protection. Not established: the disclosure date, affected version numbers, and whether anyone used it.","evidence":{"status":"verified","note":null,"sources":[{"role":"primary","label":"Check Point Research: ChatGPT Lockdown Mode Bypass: Phishing, Malware Delivery, and Silent Data Exfiltration, November 5, 2026","url":"https://research.checkpoint.com/2026/chatgpt-lockdown-mode-bypass-phishing-malware-delivery-and-silent-data-exfiltration/"}]},"strength":{"cost":"Low","commitment":"Medium","reversibility":"Easy","persistence":"Month","rationale":"Cost is low. Finding and writing up 2 misplaced sandbox tokens is a few researcher-weeks, and Check Point publishes this work to be seen. Commitment is medium: a named researcher, 4 demonstration videos and a vendor timeline are a reputational stake Check Point cannot quietly withdraw, and OpenAI confirming the fix puts the vendor on the record too. Reversibility is easy in both directions. The fix was 2 tokens removed, and the same class of mistake can return with the next preview surface. Persistence is a month, scored honestly: the specific hole is closed, and what lasts is the pattern rather than this instance. We card it because the mode's whole purpose is to be trusted."},"shift":{"prior":"A mode that blocks network access blocks your data from leaving.","action":"The post is ChatGPT Lockdown Mode Bypass: Phishing, Malware Delivery, and Silent Data Exfiltration, published Thursday November 5, 2026 at 14:00 UTC by Alexey Bukhteyev for Check Point Research. We read it at research.checkpoint.com. Lockdown Mode is an optional setting for logged-in users that restricts live web access to cached content, blocks internet images, disables network requests from code generated in Canvas, and turns off Deep Research, Agent Mode, live connectors and file downloads. In February 2026 OpenAI added an HTML page preview for ChatGPT code blocks, which renders user-controlled HTML and JavaScript inside 2 nested iframes. The sandbox intercepts outbound requests, remote images, scripts and links, and shows approval dialogs instead. It also redefines window.open, so calls to a real URL require approval while calls with an empty URL or about:blank return null silently, with no notification. The flaw: the outer iframe kept the allow-popups and allow-popups-to-escape-sandbox tokens enabled. A page could create a nested iframe and call open on that iframe's own contentWindow, reaching the real function, and content opened in the resulting popup no longer ran inside the sandbox. Check Point demonstrated 4 attacks on video: sending an entire chat history to a third-party server with no notification; malware delivery through a spoofed ChatGPT window; malware delivery through a shared chat; and credential theft by signing the user out and reloading the main window to phish the login. In the Electron-based ChatGPT Classic desktop application the post states the attack requires zero user interaction, because window.open works without a user gesture; malware delivery there still needs a click, since the application blocks automatic downloads. In a browser automatic downloads are not blocked and the victim does not need an account, so clicking content in a shared chat is enough. Delivery routes named: a malicious prompt, a malicious GPT, or a shared chat. Uploaded files were also at risk. On September 18, 2026 OpenAI told Check Point it had deployed a fix by removing both tokens from the outer preview iframe. Check Point's conclusion: guardrails and built-in security features still offer no absolute guarantee of protection. Not established: the disclosure date, affected version numbers, and whether anyone used it.","update":"Each new rendering surface reopens the question the mode had settled."},"inference":{"established":["The outer preview iframe kept allow-popups and allow-popups-to-escape-sandbox enabled.","In ChatGPT Classic the exfiltration required no user interaction.","OpenAI said on September 18 that it had removed both tokens."],"unknown":["That anyone exploited it. Check Point reports no use in the wild.","Which versions were affected. The post names no version numbers.","That other rendering surfaces are safe. Only this one was tested."]},"narrative":{"hook":"ChatGPT's Lockdown Mode could be bypassed to send an entire chat history away silently.","plain":"Check Point Research published the bypass on November 5. Caveat: OpenAI removed the two sandbox permissions behind it on September 18, and Check Point confirmed the technique no longer works.","story":["The mode was not broken by an attack on the mode. It was broken by a convenience feature shipped into it 9 months ago, carrying 2 permission tokens nobody rechecked. Every assistant is adding rendering surfaces now, and each one can hand back the capability a security setting removed."],"trail":[{"d":"FEB 2026","t":"OpenAI adds an HTML page preview for ChatGPT code blocks, rendering user-controlled HTML and JavaScript in nested iframes. The outer one keeps 2 popup tokens."},{"d":"2026","t":"Check Point discloses a separate flaw in ChatGPT's code-execution runtime, letting data leave by domain name system tunnelling. OpenAI fixes it promptly."},{"d":"OCT 2","t":"ChatGPT's free tier in the United States gains access to bank accounts and credit files. Edition 041. The material a locked-down session now holds."},{"d":"SEP 18","t":"OpenAI tells Check Point it has deployed a fix, removing allow-popups and allow-popups-to-escape-sandbox from the outer preview iframe."},{"d":"NOV 5","t":"Check Point publishes the bypass with 4 demonstration videos, 48 days after the fix and 2 days after raising its own bug bounty was carded."},{"d":"Reacts","r":true,"t":"OpenAI, which shipped the preview and the mode; every user who enabled Lockdown Mode between February and September and believed it held; the authors of malicious GPTs and shared chats, now holding a published technique; Anthropic, Google and Meta, all adding rendering surfaces to their own assistants; the state attorneys general already investigating OpenAI's data handling."}],"glossary":[{"term":"Lockdown Mode","def":"An optional ChatGPT setting that cuts live web access, images, downloads and connectors. Users turn it on when they are handling material they do not want leaving the session."},{"term":"iframe sandbox","def":"A browser restriction on embedded content. Permissions are granted by named tokens, and a token left on by mistake can undo the rest of the restriction."},{"term":"allow-popups-to-escape-sandbox","def":"A token letting a popup opened from sandboxed content run outside the sandbox. Combined with allow-popups it gave the preview a route out."},{"term":"Exfiltration","def":"Moving data out of a system to somewhere the attacker controls. Silent exfiltration leaves the user no notification and no dialog to refuse."}]},"judgment":{"prompt":"Which explanation do you believe?","interpretations":[{"id":"a","label":"Features outrun the guardrails","text":"New rendering surfaces will keep undoing security modes faster than review catches them.","abstain":false},{"id":"b","label":"One token, one mistake","text":"A configuration slip in a single preview, found and fixed in months.","abstain":false},{"id":"c","label":"A deliberate tradeoff","text":"Popups were left enabled on purpose for usability, and the risk was underweighted.","abstain":false},{"id":"d","label":"Normal software security","text":"Sandbox escapes are routine in browsers. An assistant is now a browser.","abstain":false},{"id":"e","label":"Too early to call.","text":"One finding cannot separate a slip from a pattern.","abstain":true}],"distribution":{"status":"held back until you have made your call","calls":null}},"story_thread":null,"what_to_watch":[{"linked_interpretation":"a","direction":"strengthens","observable_event":"A second published bypass of a major assistant's security or lockdown mode traces to a rendering, preview or canvas surface added after the mode shipped, by June 30, 2027.","window_end":"2027-06-30","state":"unresolved"},{"linked_interpretation":"a","direction":"weakens","observable_event":"OpenAI publishes a review of every rendering surface inside Lockdown Mode, or no comparable bypass of any assistant lockdown mode is published, by December 31, 2027.","window_end":"2027-12-31","state":"unresolved"},{"linked_interpretation":"b","direction":"strengthens","observable_event":"OpenAI or Check Point confirms the tokens were a configuration error rather than an intended usability setting, by March 31, 2027.","window_end":"2027-03-31","state":"unresolved"}]}