Researchers at Check Point have disclosed a now-patched ChatGPT vulnerability in a November 5 technical report, showing how malicious HTML previews could escape the application’s sandbox and bypass Lockdown Mode, potentially exposing private conversation data without a user’s knowledge.
The flaw affected the way ChatGPT rendered HTML page previews inside code blocks. Those previews ran in nested sandboxed frames intended to stop user-controlled content from reaching ChatGPT’s application data or making unauthorized network requests. Check Point found that the outer frame allowed pop-up windows to escape the sandbox. By creating another nested frame, the researchers could access an unmodified browser pop-up function and open content outside the original restrictions.
In the ChatGPT Classic desktop application, Check Point demonstrated that the technique could silently send chat history to an attacker-controlled server without requiring a click or other user interaction. The researchers also said the flaw could be used to expose uploaded files, display convincing phishing windows, or deliver malware through fake ChatGPT update prompts. Other attack paths involved a malicious prompt, a custom GPT, or a shared conversation containing crafted content.
OpenAI introduced ChatGPT Lockdown Mode to restrict external connections and reduce the risk of prompt-injection attacks leaking sensitive information. Check Point’s finding showed that an application feature outside the model’s normal network controls could still provide a route around those protections.
The researchers said the issue was not limited to the Electron-based desktop environment, although the zero-click data-exfiltration demonstration was specific to ChatGPT Classic. In browser-based scenarios, crafted previews could still be used to open attacker-controlled content and support phishing or malware-delivery attempts, including through shared chats.
The disclosure describes a separate weakness from the previous ChatGPT data-exfiltration issue reported by Check Point, which used an internal service to pass information between isolated ChatGPT sessions. The newly disclosed flaw involved the HTML-preview sandbox and its handling of pop-up windows.
If this article helped you, please consider supporting our work. Every small contribution keeps Abijita.com independent and running.
Check Point said it responsibly reported the vulnerability to OpenAI. OpenAI deployed a fix on September 18, 2026, by removing the allow-popups and allow-popups-to-escape-sandbox permissions from the outer HTML-preview frame. Check Point retested the issue and confirmed that the demonstrated exploit no longer worked.
