// AI threat desk · 15 Nov 2026
Home/ATK-AI · Attacks on AI
Attacks on AIMediumAISECCVSS not assigned

OpenAI ChatGPT Lockdown Mode flaw could exfiltrate chats

A ChatGPT flaw bypassed Lockdown Mode and could exfiltrate chat data; Check Point Research disclosed it on Nov 5, 2026, after OpenAI fixed it.

· 2 min read
AI-generated image of a security analyst examining a laptop with a blurred chat interface and developer tools.
AI-generated image, not a photo of the event.
Key takeaways
  • The vulnerability bypassed ChatGPT Lockdown Mode and enabled covert chat-data exfiltration.
  • In ChatGPT Classic, a conversation alone could trigger silent data exfiltration without user interaction.
  • Check Point Research said OpenAI fixed the issue on Sep 18, 2026, by removing two popup permissions from the HTML-preview sandbox iframe.

OpenAI fixed a ChatGPT vulnerability on Sep 18, 2026, after Check Point Research found that attackers could bypass Lockdown Mode and perform covert chat-data exfiltration.

The flaw exposed a wide attack surface that could enable silent exfiltration of entire chat histories and uploaded files, phishing-based credential theft, and malware delivery. In ChatGPT Classic, simply having a conversation could trigger the data exfiltration without user interaction.

The Hacker News reported that Lockdown Mode was introduced in June 2026 as an optional setting to reduce prompt-injection data-exfiltration risks. OpenAI said the setting is designed to substantially reduce that risk but does not guarantee that exfiltration cannot happen.

On this page

What happened

An attacker could reach the flaw through a malicious prompt, malicious GPT, or shared chat. The resulting activity could include malware disguised as a legitimate update and credential theft.

Lockdown Mode limits network access but disables features

The Hacker News reported that OpenAI introduced Lockdown Mode in June 2026 as an optional setting to reduce prompt-injection data-exfiltration risks. ZDNET reported that it limits outbound network requests, including requests to the internet or an external file service.

The Next Web reported that the setting disables live browsing, agent mode, deep research, image retrieval, Canvas networking, and file downloads. TechRepublic reported that it became available to eligible personal and self-serve business accounts.

PCWorld reported that OpenAI acknowledged malicious instructions could remain in uploaded files or cached content. OpenAI said Lockdown Mode does not guarantee that exfiltration cannot happen.

OpenAI told Check Point Research that it fixed the issue by removing two popup permissions from the outer HTML-preview sandbox iframe. The researchers later retested the described technique and confirmed that it no longer worked.

The finding follows an earlier Check Point Research flaw in ChatGPT’s code-execution runtime that allowed sensitive conversation data to be exfiltrated through DNS tunneling to an attacker-controlled server.

FAQ

What happened to ChatGPT Lockdown Mode?

Check Point Research found a vulnerability that allowed attackers to bypass Lockdown Mode and perform covert chat-data exfiltration. OpenAI fixed it on Sep 18, 2026.

What could the ChatGPT vulnerability expose?

The flaw could enable silent exfiltration of entire chat histories and uploaded files, malware delivery disguised as a legitimate update, and credential theft.

Did ChatGPT Classic require user interaction for the attack?

No. Check Point Research said that in ChatGPT Classic, simply having a conversation could trigger silent data exfiltration.

How did OpenAI fix the Lockdown Mode flaw?

OpenAI removed the allow-popups and allow-popups-to-escape-sandbox permissions from the outer HTML-preview sandbox iframe. Check Point Research later confirmed that the described technique no longer worked.

Sources

  1. ChatGPT Lockdown Mode Bypass: Phishing, Malware Delivery, and Silent Data Exfiltration - Check Point Research, Check Point ResearchPrimary
  2. ToFu: Exploiting and Fuzzing the LLM-Orchestrator-Tool Trust Boundary, arXivPrimary
  3. Researchers Bypass ChatGPT Lockdown Mode to Exfiltrate Chats Without User Interaction, The Hacker News
  4. How ChatGPT's new Lockdown mode protects you from data theft (and what else it does), ZDNet
  5. OpenAI Expands ChatGPT Lockdown Mode to Millions of Eligible Users, TechRepublic
  6. OpenAI adds Lockdown Mode to ChatGPT to block data theft from prompt injection attacks, The Next Web
  7. ChatGPT can be hijacked without you knowing. Lockdown Mode is the fix, PC World
  8. OpenAI Announces Unnerving New ChatGPT Feature Named ‘Lockdown Mode’, gizmodo
How we checked this story
ClaimSourceStatus
The vulnerability exposed a wide attack surface that enabled silent chat-history exfiltration, phishing-based credential theft, and malware delivery.Check Point ResearchConfirmed
In ChatGPT Classic, the attack required zero user interaction because simply having a conversation could trigger silent data exfiltration.Check Point ResearchConfirmed
An attacker could reach the vulnerability through a malicious prompt, malicious GPT, or shared chat.Check Point ResearchConfirmed
The vulnerability could enable covert theft of entire chat histories and uploaded files, malware distribution disguised as legitimate updates, and credential theft.Check Point ResearchConfirmed
Check Point Research said it responsibly disclosed the vulnerability to OpenAI.Check Point ResearchConfirmed
OpenAI told Check Point Research on 18 September 2026 that it had fixed the vulnerability by removing two popup permissions from the outer HTML-preview sandbox iframe.Check Point ResearchAttributed
Check Point Research subsequently retested the issue and confirmed that the described exploitation technique no longer worked.Check Point ResearchConfirmed
The Hacker News reported that OpenAI addressed the vulnerability on 18 September 2026 after responsible disclosure.The Hacker NewsAttributed
The Hacker News reported that Lockdown Mode was introduced in June 2026 as an optional setting intended to reduce prompt-injection data-exfiltration risks.The Hacker NewsAttributed
TechRepublic reported that Lockdown Mode became available to eligible personal and self-serve business accounts.TechRepublicAttributed
OpenAI said Lockdown Mode substantially reduces prompt-injection data-exfiltration risk but does not guarantee that exfiltration cannot happen.OpenAI, via TechRepublicAttributed
The Next Web reported that Lockdown Mode is available to logged-in users across Free, Go, Plus, Pro, and self-serve ChatGPT Business plans.The Next WebAttributed
The Next Web reported that Lockdown Mode disables live browsing, agent mode, deep research, image retrieval, Canvas networking, and file downloads.The Next WebAttributed
PCWorld reported that OpenAI acknowledged malicious instructions could remain in uploaded files or cached content.PC WorldAttributed
Gizmodo reported that OpenAI had announced Lockdown Mode as a new ChatGPT feature.gizmodoAttributed
The ToFu study evaluated 273 open-source MCP servers containing 3,405 tools and verified 253 semantic security bugs in 118 servers.arXivConfirmed
research.checkpoint.com published its report on Nov 5, 2026.research.checkpoint.comConfirmed

Could not verify

  • Whether attackers exploited the ChatGPT vulnerability against real users is not established
  • Whether OpenAI assigned a CVE to the vulnerability is not established
  • How many ChatGPT users or conversations were affected is not established
  • Whether the vulnerability affected ChatGPT versions beyond the environments described is not established
openai
See all in Attacks on AI →
Explore with AI
ChatGPT
Claude
Perplexity
Grok