--- title: ChatGPT Lockdown Mode Bypass: Phishing, Malware... description: Check Point Research found a way to bypass ChatGPT's Lockdown Mode and covertly exfiltrate chat data. The bug abused the HTML-preview sandbox for code blocks,... canonical: https://daily.dev/posts/chatgpt-lockdown-mode-bypass-phishing-malware-delivery-and-silent-data-exfiltration-6ngxmosoq twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: ChatGPT Lockdown Mode Bypass: Phishing, Malware Delivery, and Silent Data Exfiltration | daily.dev og:description: Check Point Research found a way to bypass ChatGPT's Lockdown Mode and covertly exfiltrate chat data. The bug abused the HTML-preview sandbox for code blocks,... og:url: https://daily.dev/posts/chatgpt-lockdown-mode-bypass-phishing-malware-delivery-and-silent-data-exfiltration-6ngxmosoq og:image: https://api.daily.dev/og/posts/6nGxMoSOq.png og:image:alt: ChatGPT Lockdown Mode Bypass: Phishing, Malware Delivery, and Silent Data Exfiltration og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # ChatGPT Lockdown Mode Bypass: Phishing, Malware Delivery, and Silent Data Exfiltration **[Check Point Research](https://daily.dev/sources/cpresearch)** · 7 min read · 0 upvotes · 0 comments ## Summary Check Point Research found a way to bypass ChatGPT's Lockdown Mode and covertly exfiltrate chat data. The bug abused the HTML-preview sandbox for code blocks, which left the allow-popups and allow-popups-to-escape-sandbox iframe permissions enabled. By opening a nested iframe and using its contentWindow.open, attackers could escape the sandbox, show arbitrary popups, and distribute fake malware downloads or phishing pages. In the Electron-based ChatGPT Classic app, window.open worked without any user gesture, so simply having a conversation with a malicious GPT could silently leak chat messages. OpenAI fixed the issue on September 18, 2026 by removing those two sandbox permissions, and Check Point confirmed the exploit no longer works. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How did attackers bypass ChatGPT's Lockdown Mode to exfiltrate data? Attackers exploited the HTML-preview sandbox used for code blocks, which left the allow-popups and allow-popups-to-escape-sandbox iframe permissions enabled. By creating a nested iframe inside the sandboxed page and calling its contentWindow.open function instead of the restricted window.open, attackers could open popups that executed arbitrary HTML outside the sandbox, bypassing Lockdown Mode's outbound-request restrictions. _Teams building safeguards around AI assistants track sandbox-escape disclosures like this on daily.dev._ ### Does the ChatGPT Classic Electron app require user interaction to trigger the Lockdown Mode bypass exploit? No, window.open in the Electron-based ChatGPT Classic application worked even without a user gesture, meaning an attacker could silently exfiltrate data with no clicks required. Simply having a conversation with a malicious GPT was enough to trigger the attack, as demonstrated by a malicious GPT silently leaking chat messages to an attacker-controlled server. _Developers assessing AI agent attack surfaces follow writeups like this on daily.dev._ ### Has OpenAI fixed the ChatGPT HTML preview sandbox escape vulnerability found by Check Point Research? Yes, OpenAI deployed a fix on September 18, 2026 by removing the allow-popups and allow-popups-to-escape-sandbox permissions from the outer HTML-preview sandbox iframe. Check Point Research retested the issue afterward and confirmed the exploitation technique it described no longer works. _Security-conscious developers track AI platform patch timelines like this on daily.dev._ ## Similar posts on daily.dev - [OpenAI adds Lockdown Mode to ChatGPT to block data theft from prompt injection attacks](https://daily.dev/posts/openai-adds-lockdown-mode-to-chatgpt-to-block-data-theft-from-prompt-injection-attacks-79v4ztp0j) · The Next Web · 0 upvotes · 0 comments - [ChatGPT just gave Free users a powerful defense against prompt injection attacks](https://daily.dev/posts/chatgpt-just-gave-free-users-a-powerful-defense-against-prompt-injection-attacks-8muf9rats) · XDA Developers · 0 upvotes · 0 comments - [We Took over ChatGPT Accounts](https://daily.dev/posts/we-took-over-chatgpt-accounts-bs6zmi9ki) · Hacker News · 0 upvotes · 0 comments - [Researcher Claims Control of ChatGPT Secure Sandbox](https://daily.dev/posts/researcher-claims-control-of-chatgpt-secure-sandbox-pb2mhjtib) · Dark Reading · 0 upvotes · 0 comments --- Tags: [#openai](https://daily.dev/tags/openai), [#chatgpt](https://daily.dev/tags/chatgpt), [#prompt-injection](https://daily.dev/tags/prompt-injection), [#data-exfiltration](https://daily.dev/tags/data-exfiltration) [View this post on daily.dev](https://daily.dev/posts/chatgpt-lockdown-mode-bypass-phishing-malware-delivery-and-silent-data-exfiltration-6ngxmosoq) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"ChatGPT Lockdown Mode Bypass: Phishing, Malware Delivery, and Silent Data Exfiltration","url":"https://daily.dev/posts/chatgpt-lockdown-mode-bypass-phishing-malware-delivery-and-silent-data-exfiltration-6ngxmosoq","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/chatgpt-lockdown-mode-bypass-phishing-malware-delivery-and-silent-data-exfiltration-6ngxmosoq"},"datePublished":"2026-11-05T14:10:11.159Z","dateModified":"2026-11-05T14:24:11.594Z","description":"Check Point Research found a way to bypass ChatGPT's Lockdown Mode and covertly exfiltrate chat data. The bug abused the HTML-preview sandbox for code blocks,...","image":"https://media.daily.dev/image/upload/s--58gMhC4P--/f_auto/v1722860399/public/Placeholder%2012","thumbnailUrl":"https://media.daily.dev/image/upload/s--58gMhC4P--/f_auto/v1722860399/public/Placeholder%2012","isAccessibleForFree":true,"articleSection":"Check Point Research","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Check Point Research","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/7e3b130555214df2bf737ee6c764fa42","url":"https://daily.dev/sources/cpresearch"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/chatgpt-lockdown-mode-bypass-phishing-malware-delivery-and-silent-data-exfiltration-6ngxmosoq","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"openai,chatgpt,prompt-injection,data-exfiltration","timeRequired":"PT7M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Check Point Research","item":"https://daily.dev/sources/cpresearch"},{"@type":"ListItem","position":3,"name":"ChatGPT Lockdown Mode Bypass: Phishing, Malware Delivery, and Silent Data Exfiltration"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/chatgpt-lockdown-mode-bypass-phishing-malware-delivery-and-silent-data-exfiltration-6ngxmosoq#faq","mainEntity":[{"@type":"Question","name":"How did attackers bypass ChatGPT's Lockdown Mode to exfiltrate data?","acceptedAnswer":{"@type":"Answer","text":"Attackers exploited the HTML-preview sandbox used for code blocks, which left the allow-popups and allow-popups-to-escape-sandbox iframe permissions enabled. By creating a nested iframe inside the sandboxed page and calling its contentWindow.open function instead of the restricted window.open, attackers could open popups that executed arbitrary HTML outside the sandbox, bypassing Lockdown Mode's outbound-request restrictions. Teams building safeguards around AI assistants track sandbox-escape disclosures like this on daily.dev."}},{"@type":"Question","name":"Does the ChatGPT Classic Electron app require user interaction to trigger the Lockdown Mode bypass exploit?","acceptedAnswer":{"@type":"Answer","text":"No, window.open in the Electron-based ChatGPT Classic application worked even without a user gesture, meaning an attacker could silently exfiltrate data with no clicks required. Simply having a conversation with a malicious GPT was enough to trigger the attack, as demonstrated by a malicious GPT silently leaking chat messages to an attacker-controlled server. Developers assessing AI agent attack surfaces follow writeups like this on daily.dev."}},{"@type":"Question","name":"Has OpenAI fixed the ChatGPT HTML preview sandbox escape vulnerability found by Check Point Research?","acceptedAnswer":{"@type":"Answer","text":"Yes, OpenAI deployed a fix on September 18, 2026 by removing the allow-popups and allow-popups-to-escape-sandbox permissions from the outer HTML-preview sandbox iframe. Check Point Research retested the issue afterward and confirmed the exploitation technique it described no longer works. Security-conscious developers track AI platform patch timelines like this on daily.dev."}}]} ```