ChatGPT Lockdown Mode had a gap: how a popup got chat data past it

The Morse teamPublished November 9, 20269 min read

ChatGPT Lockdown Mode is an optional security setting that limits the ways a prompt injection attack could send your data out of ChatGPT, and Check Point Research found a way around it. In research published on November 5, 2026, Check Point says HTML previews in ChatGPT's code blocks could open a popup window outside their sandbox, beyond Lockdown Mode's reach, letting a malicious prompt, GPT, or shared chat send chat data to an attacker's server. OpenAI told Check Point on September 18, 2026 that it had deployed a fix, and Check Point says the technique no longer works.

We read Check Point's research post and its companion blog post, OpenAI's Lockdown Mode announcement and help page, its help page on code previews, and the ChatGPT release notes on November 9, 2026. OpenAI hasn't published a statement about the flaw, and its release notes have no entry for the fix as of that date, so the timeline of the fix comes from Check Point alone. OpenAI deserves credit for saying on its own help page that Lockdown Mode "does not guarantee data exfiltration cannot happen."

What is ChatGPT Lockdown Mode?

It's a setting that turns features off so your data has fewer ways out. OpenAI's help page says it is designed "to help prevent the final stage of data exfiltration from a prompt injection attack by limiting outbound network requests that could transfer sensitive data to an attacker." With it on, browsing is limited to cached content, ChatGPT may not show images in replies, deep research and agent mode are off, ChatGPT can't download files for data analysis, and "users cannot approve Canvas-generated code to access the network."

It doesn't try to stop the planted instructions themselves. The same page says it "does not prevent prompt injections from appearing in the content ChatGPT processes." The idea is that a fooled model has nowhere to send what it read. Our guide to what prompt injection is covers how the instructions get in.

OpenAI announced Lockdown Mode on February 13, 2026 for "a small set of highly security-conscious users," naming executives and security teams at prominent organizations, and said it "is not necessary for most users."

How did Check Point bypass ChatGPT Lockdown Mode?

Through a popup the preview sandbox still allowed. ChatGPT can render a web page inside a code block: OpenAI's help center says you select Preview to see "HTML pages," React components, SVG images, and charts, and that "code previews and code execution use a sandboxed environment." Interactive previews arrived in ChatGPT's February 19, 2026 release notes.

Check Point's researcher, Alexey Bukhteyev, describes that sandbox as two frames, one inside the other (Check Point Research). It stopped the obvious attacks. The preview couldn't reach chatgpt.com's cookies or the page around it, and remote images and outside links were caught and turned into approval prompts. ChatGPT also swapped the page's window-opening function for one that asked you first, and that quietly did nothing for a blank window. The frames themselves, though, still carried two permissions, allow-popups and allow-popups-to-escape-sandbox.

So the researcher added a third frame inside the preview and called that frame's own window-opening function, which ChatGPT hadn't swapped, and it opened a window. Because of the second permission, code placed in it "will no longer be executed in the sandbox," Check Point writes, and Lockdown Mode's limits didn't reach it. Check Point names three ways to start the attack: "a malicious prompt, a malicious GPT, or a shared chat."

Could the flaw steal your ChatGPT chat history?

Check Point says it could. Its key takeaways say the flaw enabled "silent exfiltration of entire chat history," and it lists uploaded files too. The write-up doesn't say whether that means every chat on the account or the whole conversation the attack ran in. The demo it describes is a malicious GPT that "silently leaks chat messages to an attacker-controlled server" while you talk to it.

Check Point describes two more uses:

• Fake updates. The popup kept the ChatGPT app's icon while the attacker chose its title and content, so it could offer malware dressed as an update. In the desktop app the victim still had to click the download. In a browser, Check Point says, "the victim doesn't even need to have an account," and the attacker "only needs to share a chat containing a malicious page."
• Stolen passwords. Check Point also found it could reload the main ChatGPT window and act for the user, "such as forcibly signing them out of their account," then show a sign-in page the attacker controlled.

Was the ChatGPT desktop app more at risk?

Yes. In what Check Point calls "the Electron-based ChatGPT Classic application," the popup opened with no click at all, so "simply having a conversation would be enough to trigger the attack." Browsers normally want a click before a page opens a window. ChatGPT Classic is OpenAI's name for the previous desktop app, which can stay installed beside the new one and still gets "bug fixes, security patches." Check Point's blog version adds that "the underlying technique is not limited to the desktop environment."

Is the Lockdown Mode flaw fixed?

Yes, by Check Point's account. It says OpenAI reported on September 18, 2026 that it had removed "the allow-popups and allow-popups-to-escape-sandbox permissions from the outer HTML-preview sandbox iframe," and that a retest confirmed "the exploitation technique described in this article no longer works." The change was on OpenAI's side, so there's nothing for you to install. Neither Check Point post says whether the flaw was used against real people, and OpenAI hasn't said whether it looked.

The fix shipped 48 days before the research went public. The earlier DNS flaw is in our list of ChatGPT security incidents.

What Lockdown Mode blocks, and what the bypass used

OpenAI's list is about network features. The bypass went underneath them, through a sandbox setting none of them mention. The middle column is OpenAI's help page as we read it on November 9, 2026, and the right column is Check Point's write-up.

Check Point's write-up ends on the same point: "Securing these systems requires looking beyond individual features and considering the platform as a whole."

Who can turn on ChatGPT Lockdown Mode?

Any logged-in user, as of June 2026. Some guides updated as late as July 2026 still say it's only for Enterprise, Edu, Healthcare, and Teachers plans, which was true only at the February launch, and some reports on the bypass date its launch to June. OpenAI's release notes for June 4, 2026 say it "is now available to all logged-in users across account types and workspaces," and the announcement's June 4 update says it's "rolling out to personal ChatGPT accounts as well as self-serve ChatGPT Business accounts." The help page still hedges, saying availability "depends on your account, workspace, current product rollout, and administrator settings." In a managed workspace, an admin turns it on by assigning members to a Lockdown Mode role.

Should you turn on ChatGPT Lockdown Mode?

Yes, if you put sensitive work into ChatGPT and also open files, GPTs, or shared chats that other people made. The hole Check Point found is closed, and the limits in the table still apply. You give up live browsing, deep research, agent mode, and web images in replies. On a personal or self-serve Business account, per OpenAI's help page:

1. Open Settings and select Security.
2. Under Advanced security, turn on Lockdown Mode.
3. In the confirmation, select Turn on.

Lockdown Mode "does not change memory, file uploads, the ability to share a conversation, or whether your conversations may be used to improve models," so it doesn't replace the rest of your settings. Two habits cover what Check Point showed. Don't click previews in shared chats or GPTs from people you don't know, and if ChatGPT signs you out mid-chat and shows a sign-in page, close it and sign in at chatgpt.com yourself. Our page on whether ChatGPT is private covers memory, training, and sharing, and the shared link account takeover from October shows the steps for logging out every session.

How Morse keeps your chat history out of a stolen login's reach

Lockdown Mode limits where data can go. It doesn't change what ChatGPT keeps. Your saved chats stay on OpenAI's servers behind one sign-in, and Check Point's phishing scenario was built to steal that sign-in. Morse doesn't keep the chats on a server in the first place.

• There's no Morse password to steal. You sign in with a code emailed to you, or with Google.
• The account holds no chats. Morse's servers don't keep messages or log message content. Your account holds sign-in details, your plan, a balance, and a usage ledger with no content.
• Your history stays in your browser, encrypted. It's locked when you sign out, and unlocking it takes two keys: one that never leaves your device and one Morse's server gives you at sign-in. A copy of the browser data alone can't be read.

Clearing your browser or deleting your account deletes your chats, and Morse can't recover them, so keep a copy of anything you need. Then pick a privacy mode for each chat:

• E2EE, for the conversation you'd least want copied. Your browser checks the secure enclave's proof that it's genuine, then encrypts the message so only that enclave can read it, and Morse's servers relay ciphertext they can't read. Models there can use only tools that run on your device, so there's no web search or image generation. The enclaves are run by third-party providers, not by Morse, and the protection rests on the enclave hardware and attestation working as designed. E2EE chats come with Pro, $19 a month.
• Private, the default, for files and pages other people send you. Open them in a chat of their own, since no model is immune to prompt injection. Open-weight models like DeepSeek, Kimi, and GLM run here, plus Grok, and Morse has zero data retention agreements with its inference, search, and other providers, so they keep nothing. Where a provider confirms zero retention on each reply, Morse checks it and refuses a reply that doesn't.
• Anonymous, to use GPT, Claude, or Gemini without the provider knowing it's you. Our proxy removes your account, email, and IP address and sends the message under Morse's own account. The provider sees the message and may keep it for a limited time to check for abuse, under its own policy.

Where Lockdown Mode leaves training as it was, Morse doesn't train AI on your content, and it doesn't sell your data or show ads.

Try a chat from the Morse home page without an account, or start free and sign in with a code sent to your inbox.