ChatGPT Lockdown Mode Bypassed via HTML Preview Popup Escape

What is this?

On November 5, 2026, Check Point Research (researcher Alexey Bukhteyev) published an analysis of a flaw in the HTML page preview that ChatGPT renders from code blocks. The flaw let attacker-controlled content break out of the preview sandbox, including for users who had enabled Lockdown Mode, the optional setting that restricts outbound channels such as live web access, remote images, connectors and file downloads. OpenAI told Check Point it had deployed a fix on September 18, 2026; Check Point retested and confirmed the technique no longer works. The HTML preview feature itself was added in February 2026.

How it works

The preview runs inside two nested iframes. The sandbox intercepts external requests and turns them into approval prompts. The outer frame, however, kept the allow-popups and allow-popups-to-escape-sandbox permissions. ChatGPT overrode window.open to require approval, but only on one call path. According to the researchers, a nested frame created by the preview content had its own, unguarded popup function, so a popup could open without a prompt and run outside the sandbox, where its restrictions no longer applied.

The payload could be delivered through a crafted prompt, a malicious GPT, or a shared chat. Check Point describes the consequences as silent transfer of chat history and uploaded files, spoofed ChatGPT-styled windows (for example a fake update), and forced sign-out followed by re-authentication on an attacker page. In the Electron-based desktop client, popups did not require a user gesture, which made the exfiltration zero-click. In the browser, the main risks were spoofed popups and unblocked downloads.

Why it matters

Lockdown Mode is presented as a deterministic control against prompt-injection data theft. This finding shows that such a control is only as strong as the application environment around it: a single permissive sandbox flag undermined a feature designed for high-risk users. It also illustrates that rendering model-generated HTML is a distinct attack surface, separate from the model’s own behaviour.

Defenses

• Vendor side: remove the popup-related sandbox permissions from the outer iframe, which is the change that resolved the issue.
• Treat clicks on content inside shared chats and untrusted GPTs as potentially hazardous.
• Keep desktop AI clients updated and prefer vetted GPTs and prompts.
• Be suspicious of unexpected sign-in or “update” windows spawned from a chat.
• For builders: apply a deny-by-default iframe sandbox policy, enforce restrictions at the sandbox boundary rather than by overriding individual JavaScript functions, and test nested-frame cases.

Status

Item	Detail
Disclosed by	Check Point Research, November 5, 2026
Fix deployed	September 18, 2026 (per OpenAI to Check Point)
Affected	ChatGPT web and ChatGPT Classic desktop (most severe); mobile not addressed in the report
Status	Patched; retest confirmed by researchers