Check Point Research (CPR) has uncovered a vulnerability that could bypass ChatGPT Lockdown Mode, an advanced security feature designed to reduce the risk of sensitive information being exposed through prompt injection attacks.
The vulnerability could have enabled attackers to exfiltrate chat data, steal credentials and deliver malware through what appeared to be a trusted ChatGPT interface. Researchers also demonstrated a zero-click data exfiltration scenario in the ChatGPT desktop application, in which conversation data could be sent to an attacker-controlled server without requiring user interaction.
OpenAI fixed the vulnerability following responsible disclosure. Check Point Research confirmed that the exploitation technique described in its findings no longer works.
According to Eli Smadja, Head of Research at Check Point Research, the discovery highlights a wider challenge for enterprise AI security: protections designed to secure AI systems can be undermined by vulnerabilities in the applications and components surrounding them.
How the Lockdown Mode bypass worked
OpenAI introduced Lockdown Mode as an optional advanced security setting to reduce the risk of sensitive information leaving ChatGPT as a result of prompt injection. These attacks use malicious instructions embedded in content processed by an AI system to manipulate its behaviour or trigger unintended actions.
The feature restricts several potential outbound channels, including live web access and internet-hosted images, while disabling capabilities such as Deep Research, Agent Mode, live connectors and file downloads.
Check Point Research found an alternative route through HTML page previews within ChatGPT code blocks. The feature allows HTML content to be rendered inside the application, with a sandbox designed to prevent potentially unsafe content from accessing the main ChatGPT environment or communicating freely with external resources.
Researchers identified a weakness in how popup windows were handled within this sandbox. By exploiting the way nested frames and popup permissions interacted, they were able to bypass restrictions applied to the original HTML preview. Content opened through this route was no longer subject to the same sandbox protections, creating a way around Lockdown Mode’s security boundaries.
The finding demonstrates how a weakness in an application feature outside the AI model itself can undermine safeguards intended to protect sensitive conversations.
Data theft, phishing and malware delivery
The researchers identified several potential attack scenarios involving the vulnerability, including chat data exfiltration, credential theft and malware delivery. Depending on the scenario, an attack could originate from malicious prompts, GPTs or shared conversations.
Because attackers could control the content displayed in the popup window, they could also create convincing social-engineering lures within the ChatGPT environment.
In one demonstration involving the desktop application, researchers showed how an attacker could display a fake ChatGPT update prompt. The popup retained the application’s icon while allowing its title and content to be controlled by the attacker, potentially making a malicious download appear legitimate.
The researchers also demonstrated that the main application window could be manipulated to sign users out, creating an opportunity to redirect them to an attacker-controlled authentication page designed to capture credentials.
Although downloading a file in the desktop application still required the user to click a link, the findings showed how weaknesses in the application’s security boundaries could make phishing and malware delivery more convincing.
Zero-click data exfiltration raises the stakes
The most significant scenario involved the Electron-based ChatGPT desktop application, where the popup behaviour could be triggered without a user gesture.
Researchers demonstrated how a malicious GPT could silently transmit chat messages to an attacker-controlled server while a user was interacting with it. This meant that simply engaging with malicious content could potentially expose information from an ongoing conversation, without requiring the victim to click a link or approve an action.
The technique was not limited to the desktop environment, according to Check Point Research, although the zero-click scenario was demonstrated using the desktop application.
The implications are particularly relevant for enterprises where employees increasingly use AI assistants to process business information, uploaded documents and other potentially confidential material.
Implications for enterprise AI security
The research highlights the need for organisations to assess AI security beyond the model and its individual safeguards. Modern AI platforms bring together models, applications, browser and desktop runtimes, sandboxes, code-execution environments and connectors. Vulnerabilities in any of these components could potentially create routes around security controls.
Check Point Research recommends that organisations:
- Improve visibility into AI usage: Identify which AI services employees use and where corporate information is being shared.
- Control sensitive data exposure: Establish policies and technical safeguards governing the information employees can provide to AI services.
- Assess the wider AI attack surface: Include applications, runtimes, connectors and other components surrounding AI models in security assessments.
- Limit the impact of third-party vulnerabilities: Restrict the sensitive information available to AI services to reduce potential exposure if a platform is compromised.
Check Point noted that the relevance of its broader AI security approach lies in providing visibility into AI usage and helping organisations control what information can be shared with AI services. These measures do not address the specific ChatGPT vulnerability, but can help reduce exposure when weaknesses emerge in third-party platforms.
OpenAI deploys a fix
Check Point Research responsibly disclosed the vulnerability to OpenAI. On September 18, 2026, OpenAI informed the researchers that it had deployed a fix removing the sandbox permissions that enabled the exploitation technique. CPR subsequently retested the issue and confirmed that the method no longer worked.
For enterprises adopting AI at scale, the findings underline the importance of securing the wider environment in which AI systems operate. As assistants gain greater access to code, files and external services, organisations will need to look beyond model-level protections and strengthen visibility and control across the entire AI environment.
Pedro Drimel Neto, Malware Analyst, Team Lead, Check Point Research said: “As AI assistants evolve from simple chatbots into connected platforms that can access data, run code and interact with other systems, they are also creating new paths for attackers that traditional security models were never designed to address. This research is a reminder that securing AI cannot stop at the model or rely on a single protective control — organisations need visibility into how AI is being used, strong limits around sensitive data and access, and layered security across the entire AI environment. The goal is not to slow AI adoption, but to make sure security evolves just as quickly as the technology and the new attack surface it creates.”
Discussion about this post