ChatGPT Lockdown Mode bypass enables silent chat exfiltration
Original title: ChatGPT Lockdown Mode Bypass: Phishing, Malware Delivery, and Silent Data Exfiltration
Check Point says ChatGPT Classic needs no click: a conversation can leak full history and open phishing popups.
OpenAI’s optional Lockdown Mode is meant to stop prompt-injection attacks from sending data out through web, connector, or file-download channels. Check Point Research says a flaw in HTML page preview bypasses those limits, including zero-interaction exfiltration of an entire chat in ChatGPT Classic. The same interface manipulation can show arbitrary popups for phishing or offer malware via a malicious prompt, GPT, or shared chat. The excerpt does not say the issue is fixed.
Unconfirmed: The excerpt does not say whether OpenAI patched the bypass or whether attackers used it.
- Lockdown Mode limits live web access, remote images, Canvas network requests, and several tools.
- HTML previews use nested iframes that still allow popup sandbox permissions.
- Attacks can start from a malicious prompt, a malicious GPT, or a shared chat.
- A separate DNS-tunneling exfiltration bug was fixed earlier in 2026.
Impact: silent chat-history theft, phishing, and malware delivery
| Product | Affected |
|---|---|
| OpenAI ChatGPT | — |
- Vendors
- OpenAI
- Products
- ChatGPT
- Organizations
- Check Point Research
From the original article
7 min read at research.checkpoint.com
Research by: Alexey Bukhteyev Key Takeaways Introduction Earlier this year, Check Point Research disclosed a security flaw in ChatGPT’s code-execution runtime that allowed sensitive conversation data to be silently exfiltrated to an attacker-controlled server through DNS tunneling, a hidden outbound channel that bypassed the runtime’s network isolation. A fix for this issue was promptly deployed. […]
By stcpresearch · research.checkpoint.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.