Skip to content
NewA calmer, faster ZeroHour
StoryAI safety & securityhigh

ChatGPT Lockdown Mode Bypass Enables Silent Chat Exfiltration

2 sources · 2 articlesFirst reported Updated ()1
What's new

First merged summary.

Merged summary · x-ai/grok-4.7 · rewritten as coverage arrivesSummaries by Vani AI

Bypass in ChatGPT Lockdown Mode allows silent full chat exfiltration and phishing without interaction via HTML previews; OpenAI fixed outer iframe permissions after September 18, 2026 disclosure.

A flaw in ChatGPT's optional Lockdown Mode was found in the HTML page preview feature. Nested iframes with popup permissions like allow-popups and allow-popups-to-escape-sandbox enabled arbitrary windows and full chat history exfiltration without user gestures in the Classic desktop app. The same manipulation could display phishing popups or deliver malware disguised as updates from malicious prompts, GPTs, or shared chats. OpenAI removed the permissions after responsible disclosure on September 18, 2026.

Key facts
  • HTML preview uses nested iframes with popup sandbox permissions
  • Silent full chat history exfiltration in ChatGPT Classic
  • Phishing via arbitrary popups or malware delivery
  • Attacks start from malicious prompt, GPT, or shared chat
  • OpenAI fixed outer iframe permissions on September 18, 2026
  • Separate DNS-tunneling exfiltration bug fixed earlier in 2026
Explain this AI news with Vani AIWhat was announced, what is new and why it matters, in a new chat

Timeline

dated events in the reporting · oldest first
  1. Sep 18, 2026Responsible disclosure to OpenAI on ChatGPT bypass · GBHackers
  2. Nov 5, 2026Check Point Research discloses HTML preview bypass · Check Point Research
  3. Nov 6, 2026GBHackers reports on silent exfiltration bypass · GBHackers

What each outlet adds

beyond the shared facts
  • Check Point ResearchReported zero-interaction chat exfiltration and phishing popups from nested iframes
  • GBHackersAdded September 18, 2026 disclosure date, desktop app details, and OpenAI outer iframe fix
Vendors
OpenAI
Products
ChatGPT
Organizations
Check Point Research
AI models
ChatGPT

Coverage

oldest first · one row per article · UTC
  1. · 4d ago Check Point ResearchFirst report

    ChatGPT Lockdown Mode bypass enables silent chat exfiltration

    Check Point says ChatGPT Classic needs no click: a conversation can leak full history and open phishing popups.

  2. · 3d ago GBHackers

    ChatGPT Lockdown Mode Bypass Allows Silent Chat Exfiltration

    Researcher Alexey Bukhteyev disclosed a bypass enabling silent exfiltration of full chat histories and credential phishing from ChatGPT Classic desktop app without user interaction.