# ChatGPT: a popup escaped the preview sandbox and bypassed Lockdown Mode

> Check Point Research escaped ChatGPT's HTML preview sandbox with a nested frame, reaching data that Lockdown Mode is meant to protect.

- **Severity:** Medium: Real and reproducible, but needs unusual setup, user help or a narrow audience. Plan a fix.
- **Category:** Vulnerability
- **Published by:** Check Point Research
- **Disclosed:** 2026-11-05
- **Affects:** ChatGPT, ChatGPT Classic
- **Research by:** Alexey Bukhteyev
- **Primary source:** https://research.checkpoint.com/2026/chatgpt-lockdown-mode-bypass-phishing-malware-delivery-and-silent-data-exfiltration/
- **Page:** https://theinjection.dev/items/checkpoint-chatgpt-lockdown-mode-popup-escape/

ChatGPT's HTML preview sandbox could be escaped through a popup, letting a malicious page steal chat history, phish for credentials and push malware. Check Point says Lockdown Mode did not stop it. OpenAI fixed it on September 18.

## What happened

Alexey Bukhteyev of Check Point Research published the ChatGPT Lockdown Mode bypass on November 5, 2026, after reporting it to OpenAI privately. Check Point retested after OpenAI's fix and confirmed that the technique no longer works.

## How it works

ChatGPT renders HTML previews inside two nested sandboxed iframes, and a script overrides window.open so that outbound navigation needs user approval. The outer iframe kept the allow-popups and allow-popups-to-escape-sandbox tokens, and the override did not cover the iframe's own popup permission. Bukhteyev created a further nested iframe inside the sandboxed page and called open on that frame's contentWindow, which reached an unmodified popup function. Content opened that way ran outside the sandbox.

## Who is affected

ChatGPT in the browser and ChatGPT Classic, the Electron desktop app, were both exposed before the fix. Check Point reports that window.open worked in ChatGPT Classic without a user gesture, which made zero-click exfiltration possible there. The article does not mention the mobile apps.

## What to do

No user action is needed, because OpenAI's fix is server side and already deployed. Check Point advises limiting the sensitive data employees can share with AI services, and treating the app, runtime and connectors around a model as part of its attack surface.

## Quick facts

- **Affected:** ChatGPT in the browser, ChatGPT Classic desktop app
- **Attack type:** Sandbox escape from the HTML preview iframe
- **Found by:** Alexey Bukhteyev, Check Point Research
- **Disclosed:** November 5, 2026
- **Status:** Fixed by OpenAI on September 18, 2026
- **Fix:** allow-popups and allow-popups-to-escape-sandbox removed from the outer preview iframe

## Questions

### Is ChatGPT still vulnerable to the Lockdown Mode popup bypass?

No. Check Point Research reports that OpenAI removed the allow-popups and allow-popups-to-escape-sandbox tokens from the outer HTML preview iframe on September 18, 2026, and that a retest confirmed the technique no longer works. The fix is server side, so ChatGPT users and ChatGPT Classic desktop users do not need to install anything or change a setting.

### Does Lockdown Mode stop data exfiltration from ChatGPT?

Lockdown Mode is OpenAI's optional setting that limits outbound channels prompt injection could use, including live web access, network requests from Canvas, Deep Research, agent mode, connectors and file downloads. Check Point Research showed that it did not cover the HTML preview sandbox, where an escaped popup could still carry chat content to an attacker server. OpenAI has since closed that path.

### How did the ChatGPT desktop app allow zero-click exfiltration?

ChatGPT Classic, the Electron desktop app, let window.open run without a user gesture, which removed the click the browser version needed. Check Point Research says that simply holding a conversation with a malicious GPT could therefore leak chat messages to an attacker's server. In the browser, Check Point reports that a shared chat holding a malicious page could be enough, even for a reader without an account.

## Sources

1. [Check Point Research](https://research.checkpoint.com/2026/chatgpt-lockdown-mode-bypass-phishing-malware-delivery-and-silent-data-exfiltration/)
2. [Check Point Blog Post](https://blog.checkpoint.com/security/chatgpt-lockdown-mode-bypass-reveals-a-wider-challenge-in-ai-security)
3. [Earlier ChatGPT Leak](https://research.checkpoint.com/2026/the-shared-clipboard-inside-the-sandbox-cross-account-data-leakage-in-chatgpt/)