OpenAI’s Lockdown Mode, added to ChatGPT in June 2026 to block data leaks and prompt injections, was found to have a major weakness in the desktop app that allowed attackers to bypass its protections without any user interaction. Cybersecurity researchers from Check Point uncovered how HTML previews inside code blocks, rendered in a sandbox, could escape isolation via nested frames and popups. The issue was patched by OpenAI on September 18, 2026.
How the Vulnerability Worked
Lockdown Mode is meant to prevent outbound network requests and other actions that could allow exfiltration of sensitive information from user chats. It uses sandboxed HTML and JavaScript previews, blocking access to things like cookies or local storage, and stopping connections to external resources unless the user explicitly allows them. The reported vulnerability enabled an attacker to sneak past these controls.
Specifically, the flaw involved the way popup windows are handled during HTML previews. Even though ChatGPT blocks direct attempts to open new windows, the developers’ setup allowed nested sandboxed frames to still spawn popups that bypass the mode. A crafted HTML preview could use a nested iframe to access an unmodified popup function, effectively sidestepping Lockdown Mode’s restrictions.
Risks and Potential Impact
With the vulnerability in place, threat actors could quietly steal chat messages, deliver malicious payloads, or engage in phishing through convincing, spoofed popups—such as fake update prompts—that trick users into installing malware. These attacks could come through prompts, malicious GPTs, or shared chat links.
The problem wasn’t limited to the desktop (Electron-based) version of ChatGPT; it exposed how weaker parts of an app—beyond just the core AI model—can undermine an integrated security feature. The vulnerability was responsibly disclosed and addressed by OpenAI in mid-September.
Broader Context: AI Vulnerabilities Piling Up
This exploit joins several recent discoveries that expose vulnerabilities across AI tools and platforms. These include ways to bypass content security policies or take control of sessions through public sharing of prompts. For example, attacks have enabled hidden code execution, phishing via AI agents, and exfiltration of data from web-based tools tied to models like Claude, Copilot, or Agent frameworks.
Such exploit chains highlight a recurring theme: attackers increasingly find ways to break out of isolated environments or trust boundaries, using layers of the system that aren’t always as hardened as the model itself.
What this means going forward is clear: deploying features like Lockdown Mode isn’t enough on its own. Security needs to balance every component—from how HTML is rendered, to sandboxing, to window management—because vulnerabilities in smaller parts can still lead to critical failures. Users and organizations should monitor updates closely, apply patches, and test the full stack of protections, not just the headline features. For OpenAI, this patch is a reminder that posture matters as much as policy. Without ongoing scrutiny and layered defense, even well-intentioned safety tools can become weak spots.
