Popup Trick Slips ChatGPT Chats Past OpenAI's Lockdown Mode

Key Takeaways

• Check Point Research disclosed a ChatGPT Lockdown Mode bypass on November 5, 2026.
• A popup trick in HTML previews escaped the sandbox and skipped Lockdown Mode's network limits.
• In the desktop app, a chat with a malicious GPT could leak messages with no click.
• OpenAI fixed it on September 18, and no exploitation has been reported.

The Lockdown Had a Side Door

Lockdown Mode is meant to stop prompt injection from sending ChatGPT data out. As The Hacker News reported, researchers found a way around it through HTML previews, enabling silent chat theft, phishing, and malware delivery.

What We Know

OpenAI launched Lockdown Mode as an optional setting that limits outbound network access. It added HTML previews to code blocks in February 2026.

Researcher Alexey Bukhteyev of Check Point found the bypass and reported it. OpenAI said it deployed a fix on September 18, 2026.

Check Point published on November 5 and confirmed the technique no longer works. According to GBHackers, simply chatting triggered the leak in the ChatGPT Classic desktop app. No exploitation has been reported.

What Could Happen

HTML previews run inside two nested sandboxed frames that still allowed popups. ChatGPT replaced the popup function on the top page so users had to approve each one.

That safeguard only covered one level. A script could add another frame, call its untouched popup function, and run any content outside the sandbox and outside Lockdown Mode's limits.

An attacker could then send full chat history to an outside server, or show a fake ChatGPT update window that pushes malware.

Why It Matters

Lockdown Mode is used by people with the most sensitive data, such as executives and security teams. A bypass removes protection exactly where it matters most.

The flaw was not in the model. It was in an ordinary app feature built around it, showing that AI security controls are only as strong as their surroundings.

Organizations should not rely on one vendor setting alone. Layered data protection and governance, as the NIST AI RMF encourages, reduce the impact when a control fails.

PointGuard AI Perspective

The bypass shows that a single built-in control cannot carry AI data protection alone. PointGuard AI adds independent layers.

PointGuard AI runtime guardrails detect prompt injection and jailbreak attempts with fine-tuned models in under 100 milliseconds. They also scan retrieved content and tool outputs before they reach the model.

AI data protection provides AI-native data leak detection across prompts, responses, and tool calls, catching sensitive data such as PII, financial records, and source code before it leaves.

AI discovery shows which AI assistants and custom GPTs employees use, so security teams know where controls like Lockdown Mode are, or are not, in place.

Trustworthy AI adoption means layering protections so that one bypass does not become a breach.

Incident Scorecard Details

Total AISSI Score: 5.40/10

Criticality: 7, Full chat histories of high-risk users were exposed. AISSI weighting: 25%

Propagation: 5, Any malicious GPT or shared content could trigger it, within one service. AISSI weighting: 20%

Exploitability: 4, Working demonstration, no observed exploitation. AISSI weighting: 15%

Supply Chain: 7, Risk sat entirely in a hosted third-party AI service. AISSI weighting: 15%

Business Impact: 4, Fixed before disclosure with no reported harm. AISSI weighting: 25%

Sources

Third-Party Sources

• The Hacker News: Researchers Bypass ChatGPT Lockdown Mode to Exfiltrate Chats
• GBHackers: ChatGPT Lockdown Mode Bypass Allowed Hackers to Steal Private Chats

PointGuard AI Sources

• PointGuard AI Runtime Guardrails
• PointGuard AI Data Protection
• PointGuard AI Discovery