Check Point says it got past ChatGPT's Lockdown Mode to steal chat data with no clicks in the desktop app, a flaw OpenAI fixed on 18 September

Check Point Research published on 5 November a way round Lockdown Mode, the optional ChatGPT setting meant to stop prompt-injection attacks from taking users' data.

The researchers say they escaped the sandbox ChatGPT uses to preview HTML from code blocks. The outer frame still allowed pop-ups to leave the sandbox, and a nested frame got round ChatGPT's own block on opening new windows. An attacker could deliver it through a crafted prompt, a malicious GPT or a shared chat, Check Point says.

In the Electron desktop app, the researchers say, an attacker could take private data with no click from the user. In the browser, shared chats could be used to deliver malware, for example through a fake update page.

Check Point gives no date for its report to OpenAI. It says OpenAI told it on 18 September that it had deployed a fix by removing the pop-up permission, and that a retest confirmed the technique no longer works. The Hacker News also reported the findings.

• Confirmed Check Point says OpenAI informed it on 18 September 2026 that it had deployed a fix. Check Point Research, 5 Nov 2026
• Claimed Check Point says an attacker could trigger zero-click exfiltration of private data in the desktop app. Check Point Research
• Reported The Hacker News reported that researchers bypassed ChatGPT's Lockdown Mode. The Hacker News