Is ChatGPT still vulnerable to the Lockdown Mode popup bypass?

No. Check Point Research reports that OpenAI removed the allow-popups and allow-popups-to-escape-sandbox tokens from the outer HTML preview iframe on September 18, 2026, and that a retest confirmed the technique no longer works. The fix is server side, so ChatGPT users and ChatGPT Classic desktop users do not need to install anything or change a setting.

Does Lockdown Mode stop data exfiltration from ChatGPT?

Lockdown Mode is OpenAI's optional setting that limits outbound channels prompt injection could use, including live web access, network requests from Canvas, Deep Research, agent mode, connectors and file downloads. Check Point Research showed that it did not cover the HTML preview sandbox, where an escaped popup could still carry chat content to an attacker server. OpenAI has since closed that path.

How did the ChatGPT desktop app allow zero-click exfiltration?

ChatGPT Classic, the Electron desktop app, let window.open run without a user gesture, which removed the click the browser version needed. Check Point Research says that simply holding a conversation with a malicious GPT could therefore leak chat messages to an attacker's server. In the browser, Check Point reports that a shared chat holding a malicious page could be enough, even for a reader without an account.

MEDVulnerability

ChatGPT: a popup escaped the preview sandbox and bypassed Lockdown Mode

Check Point Research escaped ChatGPT's HTML preview sandbox with a nested frame, reaching data that Lockdown Mode is meant to protect.

November 5, 2026 · Check Point Research · Research by Alexey Bukhteyev

ChatGPT

MEDVulnerability

ChatGPT's HTML preview sandbox could be escaped through a popup, letting a malicious page steal chat history, phish for credentials and push malware. Check Point says Lockdown Mode did not stop it. OpenAI fixed it on September 18.

01What happened

Alexey Bukhteyev of Check Point Research published the ChatGPT Lockdown Mode bypass on November 5, 2026, after reporting it to OpenAI privately. Check Point retested after OpenAI's fix and confirmed that the technique no longer works.

02How it works

ChatGPT renders HTML previews inside two nested sandboxed iframes, and a script overrides window.open so that outbound navigation needs user approval. The outer iframe kept the allow-popups and allow-popups-to-escape-sandbox tokens, and the override did not cover the iframe's own popup permission. Bukhteyev created a further nested iframe inside the sandboxed page and called open on that frame's contentWindow, which reached an unmodified popup function. Content opened that way ran outside the sandbox.

03Who is affected

ChatGPT in the browser and ChatGPT Classic, the Electron desktop app, were both exposed before the fix. Check Point reports that window.open worked in ChatGPT Classic without a user gesture, which made zero-click exfiltration possible there. The article does not mention the mobile apps.

04What to do

No user action is needed, because OpenAI's fix is server side and already deployed. Check Point advises limiting the sensitive data employees can share with AI services, and treating the app, runtime and connectors around a model as part of its attack surface.

Questions people ask

Is ChatGPT still vulnerable to the Lockdown Mode popup bypass?: No. Check Point Research reports that OpenAI removed the allow-popups and allow-popups-to-escape-sandbox tokens from the outer HTML preview iframe on September 18, 2026, and that a retest confirmed the technique no longer works. The fix is server side, so ChatGPT users and ChatGPT Classic desktop users do not need to install anything or change a setting.
Does Lockdown Mode stop data exfiltration from ChatGPT?: Lockdown Mode is OpenAI's optional setting that limits outbound channels prompt injection could use, including live web access, network requests from Canvas, Deep Research, agent mode, connectors and file downloads. Check Point Research showed that it did not cover the HTML preview sandbox, where an escaped popup could still carry chat content to an attacker server. OpenAI has since closed that path.
How did the ChatGPT desktop app allow zero-click exfiltration?: ChatGPT Classic, the Electron desktop app, let window.open run without a user gesture, which removed the click the browser version needed. Check Point Research says that simply holding a conversation with a malicious GPT could therefore leak chat messages to an attacker's server. In the browser, Check Point reports that a shared chat holding a malicious page could be enough, even for a reader without an account.

Sources 3 links, all fetched

1research.checkpoint.comCheck Point Research
2blog.checkpoint.comCheck Point Blog Post
3research.checkpoint.comEarlier ChatGPT Leak