OpenAI’s Lockdown Mode, a security setting designed to blunt prompt-injection attacks, could be circumvented in a way that let an attacker pull an entire ChatGPT conversation history off a victim’s machine, according to research from Check Point Research. The flaw has since been closed.
The weakness lay in the HTML preview feature OpenAI added to ChatGPT code blocks in February 2026, which renders model-generated web code inside a sandbox. That sandbox permitted popups, so a nested frame could spawn a new window that fell outside Lockdown Mode’s protections, and data flowing from that window could be routed to an attacker-controlled server. Check Point said an attack could be launched through a malicious prompt, a malicious GPT or a shared chat.
The exposure was not uniform across clients. In a browser, the victim still had to click the preview, though an attacker could dress it up to look innocuous. The Electron-based ChatGPT Classic desktop app was the more dangerous surface: it opened new windows without any user action at all, so simply holding a conversation was enough to leak the chat history, according to the researchers. Phishing forms opened from that same window also appeared to be part of ChatGPT itself, making fake sign-in screens harder to spot.
OpenAI patched the issue on September 18, and Check Point retested afterward and confirmed the technique no longer works. Users do not need to take any action, since the fix was applied on OpenAI’s servers.
| Element | Detail |
|---|---|
| Root cause | HTML preview sandbox in ChatGPT code blocks allowed popups, letting a nested frame open an uncovered window |
| Attack vectors | Malicious prompt, malicious GPT, shared chat |
| Browser exposure | Required a click on the preview |
| ChatGPT Classic exposure | New windows opened with no user action; conversation alone leaked history |
| Fix date | September 18, 2026 |
| Verification | Check Point retested and confirmed the technique fails |
Note: Dates and details as reported by Check Point Research and OpenAI documentation.
The HTML preview was also implicated in a separate flaw involving shared ChatGPT links that exposed private conversations the previous month, a reminder that preview rendering has become a recurring weak point in the product’s attack surface.
Lockdown Mode itself remains a worthwhile control, but OpenAI is explicit that it is not a universal setting. The company says it “is not intended for everyone” and positions it for individuals and organizations handling sensitive data. Enabling it disables a substantial list of capabilities: web browsing is confined to cached content, images are not fetched from the web, and Deep Research, Agent Mode, live connectors and file downloads are switched off. Image generation continues to function. The toggle does not affect whether conversations are used for model training, which is governed separately through data controls.
The setting lives under Settings, then Security, then Advanced security, and is available to eligible personal accounts and self-serve ChatGPT Business accounts depending on plan and rollout. It can be turned off for a single chat from the chat menu. For shared chats of unknown provenance, opening them in a private browser window without signing in is the safer route. The per-chat PIN lock, meanwhile, only prevents someone with physical access to a device from reading a conversation; it offers no defense against the class of attack described here.
Separately, OpenAI this week introduced GPT-6 Cyber, a model it is restricting to vetted security teams rather than releasing publicly. According to the company, the system identified 948 privilege-escalation vulnerabilities in the Linux kernel over seven days at a token cost of about $1.21 million, work it framed as equivalent to roughly 50 years of human security research. OpenAI said the model also surfaced 81 previously unknown high-severity flaws with reproduction code and patches, some of which shipped to users in Firefox 159. The company paired the launch with a $1 billion “Daybreak Defenders” funding program.
The two developments point in the same direction for enterprises weighing AI deployment. Model capability is advancing faster than the guardrails around it, and the safeguards that do exist tend to be narrow by design. Lockdown Mode reduces a specific category of risk, but the Check Point findings show that a single rendering feature with permissive defaults can undo much of that protection, particularly in desktop clients that act without user consent. Security teams evaluating ChatGPT for sensitive work should treat preview rendering, shared-link handling and desktop client behavior as distinct risks rather than assuming a single toggle covers them, and should press vendors on how quickly such gaps are patched and disclosed.
For OpenAI, the disclosure is a test of how it manages the tension between shipping features quickly and securing them. The company fixed the flaw before public disclosure and the research firm confirmed the fix, which is the outcome regulators and corporate buyers want to see. But the episode also illustrates why Lockdown Mode’s own documentation warns that it is not for everyone: the strongest protections come at the cost of functionality, and the weaker ones can be routed around.