A flaw in ChatGPT let attackers bypass Lockdown Mode, the setting built to stop prompt injection stealing private data, and silently send chat history to an attacker's server. Check Point Research published the findings on 5 November 2026. OpenAI has already fixed it, so this is a disclosure of a closed hole, not an active emergency — a warning about AI safety controls.

Lockdown Mode is an optional setting that limits how data can leave a conversation, restricting web access to cached content, blocking web images, and turning off Canvas networking, Deep Research, Agent Mode and live connectors. The weakness was not in the model. It lived in the HTML page preview feature, added in February 2026, which renders HTML inside code blocks as a live page inside two nested sandboxed frames.

The outer sandbox allowed popups to escape it. OpenAI's scripts overrode the popup function so new windows needed approval, but the override only covered the top-level page. Bukhteyev created another nested frame inside the rendered page and called its popup function, reaching a popup that ran arbitrary HTML outside both.

Zero-click theft in the desktop app

In the Electron-based ChatGPT Classic desktop app, the popup opened without any user gesture. A malicious prompt, malicious GPT or shared chat could silently send chat messages to an attacker's server while the victim simply kept talking. The same route could also show phishing windows or offer malware disguised as a ChatGPT update.

Check Point disclosed the issue responsibly. OpenAI said on 18 September 2026 that it had removed those popup permissions, and researchers retested and confirmed the technique no longer works. The fix is server-side, so users need install nothing. Check Point's lesson: AI security controls are only as strong as the application around them.