ChatGPT Lockdown Mode bypass fixed after popup flaw

Check Point researchers found a popup escape that could steal ChatGPT desktop chats without a user click, despite ChatGPT Lockdown Mode. The bypass abused HTML previews, and OpenAI fixed it on September 18, 2026. For teams reviewing exposure, the immediate task is to establish how that fix covers their deployment—not assume the setting alone guarantees containment.

The Hacker News reports that Check Point also flagged possible phishing and malware-delivery consequences. The account gives neither affected nor fixed desktop build numbers, nor a version-check command, so it cannot support a version-based fleet check on its own.

Check coverage of the ChatGPT Lockdown Mode popup fix

OpenAI has addressed the vulnerability, but the reported fix date is not a desktop version identifier. For a managed deployment, use the following review rather than invent a patch command or assume a particular build is safe.

1. Ask whoever manages ChatGPT access to establish how OpenAI's September 18, 2026 fix applies to the organisation's desktop and browser use. Record the basis for that confirmation separately from the fact that OpenAI addressed the issue.
2. Review where staff encounter HTML previews from untrusted material. Check Point identified crafted prompts, malicious GPTs and shared chats as possible delivery routes, so a review limited to directly pasted prompts would miss part of the reported exposure.
3. Keep software-installation decisions separate from content displayed inside a preview or popup. The researchers described a fake ChatGPT update as a possible lure; a convincing update message in that content should not become an installation instruction.
4. Retain Lockdown Mode as a risk-reduction control, while checking what other application features can do. Enabling it and confirming this particular fix are different checks, not interchangeable evidence.

I consider these review recommendations, not a vendor-supplied remediation procedure. The report does not provide a menu path, command or build mapping to verify the patch locally. I think filling that absence with a guessed version would make the checklist look more complete while making its conclusion less trustworthy.

How the sandbox boundary broke

The escape started in the application's HTML-preview machinery. ChatGPT can render HTML from code blocks directly inside the application. Because that content can include HTML and JavaScript supplied by a user, it runs in a sandbox rather than receiving unrestricted access to the surrounding app.

That sandbox is intended to separate rendered content from application data such as cookies and local storage. It also prevents communication with external resources without user consent. Lockdown Mode adds a related restriction: it limits outbound network requests that could carry sensitive information to infrastructure controlled by an attacker.

1. Check Point found that the preview used nested sandboxed frames, but its handling of new windows did not match the permissions underneath. ChatGPT intercepted direct attempts to open windows. The sandbox nevertheless permitted popups and allowed them to leave its restrictions.
2. The researchers added another nested frame inside the rendered page. From there, they could reach a popup function that had not received the original preview's interception. Content opened through that route no longer faced the same sandbox restrictions, creating an alternative path around the network protections.

Intercepting window-opening attempts did not remove the underlying popup permission. The initial preview could appear restricted while a nested route still reached a permitted operation. I see this as an application-containment failure, not a finding that depended solely on persuading the model to ignore an instruction.

Silent chat theft and fake updates require different responses

Check Point described potential data theft alongside phishing and malware delivery. I don't think those outcomes should be collapsed into a single claim that merely opening any malicious content automatically installed malware.

• For data exfiltration, the researchers said the bypass could enable silent theft of chat information, including without user interaction in the desktop application. My concern is that escaped content could use a path that the intended restrictions should have prevented.
• For malware delivery, an attacker could control what appeared in the popup and present a persuasive lure, such as a fake ChatGPT update. The described scenario then involved convincing the victim to click a link and download malware.

I think that distinction matters when choosing controls. Advice to avoid clicking suspicious update links addresses the social-engineering route. It does not, by itself, address a reported zero-click exfiltration path.

My priority would be confirming the application fix before treating user awareness as the main defence. Staff still need a clear way to reject unexpected update prompts, but a control that depends on recognising a lure cannot substitute for closing a route that researchers say required no click.

The delivery surface also matters. A malicious shared conversation or GPT need not look like a software download to introduce the relevant content. Check Point's account places those routes alongside crafted prompts, making the trust placed in imported conversation material part of the review.

The shared-chat account takeover was a separate finding

Parameter Labs disclosed another ChatGPT issue involving public share links and HTML previews. Keeping it separate prevents an easy but consequential mix-up: Check Point's popup bypass and Parameter Labs' account-takeover account are not presented as the same vulnerability.

In the Parameter Labs scenario, an attacker could publish a malicious conversation through ChatGPT's normal sharing feature and send its link to another user. Researcher Mukul Goyal said the payload could execute with access to the victim's authenticated web session when the shared content was opened.

The reported interaction involved clicking the HTML preview once; an HTML block marked as previewable could open automatically. That is a distinct execution path from Check Point's description of nested frames reaching an unrestricted popup route.

I would keep these disclosures separate in an internal advisory, particularly when recording which fix has been confirmed. I don't think the September 18 patch date should be stretched into evidence that every related shared-chat or preview issue received the same remediation.

No build mapping or confirmed exploitation is reported

The account establishes that OpenAI addressed this vulnerability, but it does not identify affected or fixed desktop builds. It also does not provide a command for checking the running version.

The report describes what the ChatGPT Lockdown Mode bypass could enable; it does not report confirmed exploitation of this particular flaw in the wild. I think that distinction should remain intact in a company risk assessment. I don't think a demonstrated route to data theft is evidence that a particular organisation's chats were stolen.

Check Point also said the underlying problem was not limited to the Electron-based desktop environment. The report specifically attributes zero-click exfiltration to the desktop application, however, and does not supply a complete browser-by-browser exposure breakdown. I don't think switching away from the desktop client can be presented here as a verified workaround.

Finally, the fix addresses the disclosed vulnerability, not a guarantee against every future prompt-injection or preview-related failure. The finding supports reviewing the surrounding application boundary; I don't think it establishes that all preview content is malicious or that all security controls failed.

Review HTML-preview permissions alongside model safeguards

For developers building assistants, the useful lesson is to inspect the environment that renders and acts on model output. Check Point's finding concerned frames, popup handling and outbound communication—parts of the application surrounding the model.

“The finding raises a broader enterprise security issue: AI security controls are only as strong as the wider application environment around them.”

— Eli Smadja, head of research at Check Point

Say an internal assistant displays generated HTML alongside company support discussions. In that design, I'd review the original preview, nested frames and popup behaviour as connected parts of one containment system. Testing only the first visible frame would not address the route described in this disclosure.

I think a review based on this finding should ask for specific evidence:

• I'd have the review establish what permissions nested frames inherit, rather than assume they receive every restriction applied to the original preview.
• I'd have the review establish whether popups remain subject to the intended containment, including the outbound-network restrictions that protect conversation data.
• I'd have the review distinguish application-level interception from underlying sandbox permissions, so blocking one visible route is not mistaken for removing the capability.

The report supplies no implementation flags or test code, so I don't think there is a sound basis for adding a copy-and-paste sandbox configuration here.

My verdict: keep ChatGPT Lockdown Mode as a useful restriction, confirm coverage of OpenAI's fix, and reject preview content as an authority for software installation. For assistant builders, the stronger takeaway is to test whether the surrounding application actually enforces the boundary the security setting promises.