Researchers found a way to bypass ChatGPT Lockdown Mode and steal chats

How the flaw works

Researchers at Check Point discovered a vulnerability in OpenAI's ChatGPT desktop app that allowed attackers to bypass Lockdown Mode, a security feature introduced in June 2026. Lockdown Mode was designed to limit data exfiltration (unauthorised data transfer) by restricting outbound network requests from the app, especially those triggered by prompt injection attacks. Prompt injection is when an attacker tricks an AI model into following hidden instructions embedded in user input.

The flaw was in how ChatGPT handled popup windows during HTML previews. The app used nested sandboxed frames to isolate content, and it intercepted direct attempts to open new windows. However, the underlying sandbox permissions still allowed popups to escape these restrictions. By creating another nested frame, attackers could access an unmodified popup function and bypass Lockdown Mode. This allowed content loaded in the popup to avoid the usual security checks, creating a path for data to be exfiltrated or for malicious payloads to be delivered.

What was taken

The vulnerability could have allowed attackers to silently steal chat data from users without any interaction. According to Check Point, attackers could use a crafted prompt, a malicious GPT, or a shared chat to trigger the exploit. Once the popup was opened outside the sandbox, it could send chat messages or other sensitive information to an attacker-controlled server. The flaw also enabled attackers to deliver malware or create convincing phishing lures, such as fake ChatGPT updates, to trick users into downloading malicious files.

The response

Check Point responsibly disclosed the vulnerability to OpenAI, and the company patched the flaw on 18 September 2026. The researchers highlighted that the issue was not limited to the Electron-based desktop app, suggesting similar risks could exist in other environments where AI features interact with web technologies. OpenAI has not published a detailed advisory, and there is no evidence the flaw was exploited before the patch.

What experts say

Check Point's head of research, Eli Smadja, said the finding shows that AI security controls like Lockdown Mode are only as strong as the wider application environment. Weaknesses in how features are implemented can undermine even well-designed protections. The report also referenced other recent vulnerabilities in AI tools, including attacks that exploit preview features, browser integrations, and agent frameworks to steal data or run malicious code.

What you should do

If you use ChatGPT, make sure your app is up to date. Organisations deploying AI tools should review how web content is handled, especially when features like HTML previews or popups are involved. Security teams should test AI applications for ways attackers could bypass controls through the user interface or supporting technologies, not just the AI model itself.