Researchers Bypass ChatGPT Lockdown Mode to Exfiltrate Chats Without User Interaction

Summary

Check Point researcher Eli Smadja disclosed a now-patched flaw that let attackers bypass Lockdown Mode, the optional setting OpenAI introduced in June 2026 to limit data exfiltration from prompt injections in ChatGPT. The issue stemmed from HTML page previews in code blocks, where nested sandboxed frames still permitted popups to escape the sandbox, letting attackers exfiltrate chat data or deliver lures and malware, including zero-click exfiltration in the ChatGPT desktop application. OpenAI addressed the vulnerability on September 18, 2026.

Mitigation

Fixed by OpenAI on September 18, 2026.

Related items

• InfoPerplexity launches its own take on AI agents for workSame vendor · The Verge (AI)
• MediumBinance heist is stark example of AI governance gaps and basic security failuresSame vendor · CSO Online
• MediumFake OpenAI, SpaceX events used to steal Microsoft, Google accountsSame vendor · BleepingComputer
• LowOpenAI’s GPT-6 Astra silently obstructed safety research tasksSame vendor · BleepingComputer
• InfoWinner of the Prix Goncourt literary prize admits to using AISame vendor · The Guardian Technology