{"id":4009,"date":"2026-11-06T09:29:17","date_gmt":"2026-11-06T17:29:17","guid":{"rendered":"https:\/\/cyber.mag212.com\/chatgpt-lockdown-mode-bypass-check-point-html-preview\/"},"modified":"2026-11-06T09:29:17","modified_gmt":"2026-11-06T17:29:17","slug":"chatgpt-lockdown-mode-bypass-check-point-html-preview","status":"publish","type":"post","link":"https:\/\/cyber.mag212.com\/fr\/chatgpt-lockdown-mode-bypass-check-point-html-preview\/","title":{"rendered":"ChatGPT Lockdown Mode Bypass: How Check Point Escaped the HTML Preview Sandbox to Exfiltrate Chats"},"content":{"rendered":"

MAG212 CYBER | AI Security | November 6, 2026<\/strong><\/p>\n\n\n\n

Check Point Research (CPR)<\/strong> has disclosed a way around ChatGPT Lockdown Mode<\/strong>, the optional setting OpenAI built to stop data leaking out of conversations through prompt injection. The weakness was not in the model. It sat in the sandbox ChatGPT uses to render HTML previews<\/strong> in code blocks, which allowed popups to escape and bypass the controls Lockdown Mode depends on. CPR demonstrated silent chat exfiltration, a fake-update malware lure and a forced sign-out leading to a phishing page. OpenAI deployed a fix by 18 September 2026<\/strong>, and Check Point published the research on 5 November<\/strong>.<\/p>\n\n\n\n

Faits cl\u00e9s<\/h2>\n\n\n\n
Article<\/th>D\u00e9tail<\/th><\/tr><\/thead>
Researchers<\/strong><\/td>Alexey Bukhteyev (technical write-up); blog by Eli Smadja, Head of Research, Check Point Research<\/td><\/tr>
Published<\/strong><\/td>5 November 2026<\/td><\/tr>
Affected feature<\/strong><\/td>HTML page previews in ChatGPT code blocks (added February 2026)<\/td><\/tr>
Root cause<\/strong><\/td>Outer preview iframe had allow-popups<\/code> et allow-popups-to-escape-sandbox<\/code><\/td><\/tr>
Control bypassed<\/strong><\/td>ChatGPT’s popup interception, and with it Lockdown Mode’s exfiltration controls<\/td><\/tr>
Worst case<\/strong><\/td>Zero-click chat exfiltration in the Electron-based ChatGPT Classic desktop app<\/td><\/tr>
Fix\u00e9<\/strong><\/td>OpenAI told CPR a fix was deployed on 18 September 2026; CPR confirmed it no longer works<\/td><\/tr>
CVE<\/strong><\/td>None mentioned by Check Point<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

What Lockdown Mode is<\/h2>\n\n\n\n

OpenAI introduced Lockdown Mode on 13 February 2026, initially for ChatGPT Enterprise, Edu, ChatGPT for Healthcare and ChatGPT for Teachers. A 4 June update extended it to personal accounts and self-serve ChatGPT Business. It restricts live web access (cached content only), images in responses, Deep Research, Agent Mode, Canvas networking, live connectors and file downloads. Personal users turn it on under Settings > Security<\/strong>; admins create a role in Workspace Settings and choose which apps and actions stay available.<\/p>\n\n\n\n

OpenAI describes it as optional and aimed at a small group of highly security-conscious users. According to The Hacker News, OpenAI said it is “designed to reduce the risk of data exfiltration from prompt injection attacks by limiting outbound network requests” and “does not guarantee that data exfiltration cannot happen.” In our assessment, that makes this bypass notable: it broke the expectations of exactly the users who switched the mode on to stop exfiltration.<\/p>\n\n\n\n

How the bypass worked<\/h2>\n\n\n\n

When ChatGPT shows an HTML preview, the page’s code runs inside a sandbox that CPR says is “implemented in two nested iframes”. An iframe is a page embedded inside another page, and the browser’s sandbox settings decide what it may do. ChatGPT also watches outbound requests from the preview and turns them into approval dialogs, so the user has to say yes before data leaves.<\/p>\n\n\n\n

The weak point was popups. ChatGPT replaced the preview’s window.open<\/code> function with its own version that asked for approval, and calls with an empty URL or about:blank<\/code> silently failed. But the outer iframe was allowed to open popups, and those popups were allowed to escape the sandbox. CPR found that if the preview code simply created a fresh iframe of its own, that new frame came with an original, unmodified window.open<\/code>. Calling it opened a popup that ChatGPT’s interception never saw, and the popup’s contents ran without a sandbox.<\/p>\n\n\n\n

Technical detail.<\/strong> The outer HTML-preview iframe carried the sandbox tokens allow-popups<\/code> et allow-popups-to-escape-sandbox<\/code>. ChatGPT’s sandbox script overrode window.open<\/code> in the preview’s own window, but not in child frames created at runtime. In CPR’s example, window.open(\"about:blank\")<\/code> is blocked, while f.contentWindow.open(\"about:blank\")<\/code>, where f<\/code> is a newly created nested iframe, succeeds. Because of allow-popups-to-escape-sandbox<\/code>, the resulting window runs outside the sandbox, beyond the reach of ChatGPT’s request approvals.<\/p>\n\n\n\n

Three demonstrated impacts<\/h2>\n\n\n\n

CPR showed three attacks. They differ in how much the victim had to do, and that difference matters.<\/p>\n\n\n\n

Attack<\/th>What happens<\/th>User interaction<\/th><\/tr><\/thead>
Silent chat exfiltration<\/strong><\/td>A malicious GPT, prompt or shared chat sends conversation messages to an attacker’s server<\/td>Aucun<\/strong> in the ChatGPT Classic desktop app, where window.open<\/code> “works even without a user gesture” and “simply having a conversation would be enough”<\/td><\/tr>
Fake-update malware lure<\/strong><\/td>A popup keeps the ChatGPT icon while the attacker controls its title and content, presenting a fake update<\/td>Clicks required.<\/strong> In the desktop app the user must click the preview, then the download link, because the app blocks automatic downloads<\/td><\/tr>
Forced sign-out and phishing<\/strong><\/td>The popup reloads the main ChatGPT window, signs the user out and redirects to an attacker-controlled login page<\/td>Aucun<\/strong> in ChatGPT Classic, according to CPR<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

In web browsers, popups normally need a user action, so the browser case is less automatic. CPR notes, however, that downloads were “not blocked” there, and that shared chats can reach victims who do not even have accounts. Its advice was that “any clicks on content in shared chats” carried risk.<\/p>\n\n\n\n

Disclosure and fix<\/h2>\n\n\n\n

CPR reported the issue to OpenAI through responsible disclosure; the report date is not stated. On 18 September 2026<\/strong>, OpenAI told CPR it had deployed a fix that removed allow-popups<\/code> et allow-popups-to-escape-sandbox<\/code> from the outer preview iframe. CPR retested and confirmed the technique “no longer works”.<\/p>\n\n\n\n

Neither Check Point page mentions a CVE, a bug bounty or a public statement from OpenAI.<\/p>\n\n\n\n

This is not CPR’s first ChatGPT finding. It previously disclosed a DNS-tunneling exfiltration flaw in ChatGPT’s code-execution runtime, which it says was “promptly” fixed.<\/p>\n\n\n\n

Pourquoi c'est important<\/h2>\n\n\n\n

In our assessment, this was a classic web-sandbox misconfiguration, overly permissive iframe tokens, rather than a failure of the model to resist prompt injection. Lockdown Mode worked as designed at the AI layer. The leak came from the application wrapped around it.<\/p>\n\n\n\n

Check Point’s Eli Smadja puts it this way: “AI security controls are only as strong as the wider application environment around them.” AI assistants now render HTML, run code, call connectors and ship as desktop apps. Each of those is conventional software with conventional bugs, and each one can undo an AI-specific safeguard.<\/p>\n\n\n\n

What organizations using AI assistants should do<\/h2>\n\n\n\n

Check Point recommends the following, with our additions:<\/p>\n\n\n\n