A feature OpenAI built specifically to stop data theft from ChatGPT could be sidestepped with a few lines of JavaScript, letting an attacker quietly copy a user's entire chat history to an outside server. Check Point Research disclosed the flaw on November 5, crediting researcher Alexey Bukhteyev, after OpenAI fixed it in September.
The bypass defeated Lockdown Mode, an optional setting for logged-in ChatGPT users that is meant to blunt prompt injection, the trick of hiding instructions in content an AI reads so that it works against its own user. Lockdown Mode shuts the doors data could leave through: it limits web access to cached content, blocks images from the internet, stops network requests from Canvas-generated code, and turns off Deep Research, Agent Mode, live connectors and file downloads. Check Point found a door it had missed.
A popup that escaped the sandbox
In February 2026 OpenAI added a live HTML preview to ChatGPT code blocks. Because rendering attacker-controlled HTML inside ChatGPT is risky, the preview runs inside two nested sandboxed iframes, and any attempt to load outside resources or open a window is intercepted and shown to the user as an approval prompt. ChatGPT enforces the popup rule by replacing the page's own window.open function with a guarded version.
The researchers noticed that the sandbox itself still carried two permissive settings, allow-popups and allow-popups-to-escape-sandbox, and that the guarded function only covered the preview's own window. By creating one more iframe inside the preview and calling that frame's untouched open function, they could open a real popup. Because of the second setting, whatever HTML they placed in that popup ran outside the sandbox entirely, and outside Lockdown Mode's restrictions with it.
Zero clicks needed in the desktop app
Browsers normally require a click before a page can open a popup, so in a browser the attack needs a lure. Check Point says that is easy to supply, since the attacker controls the whole preview page. The resulting window kept the ChatGPT icon while showing an attacker-chosen title, which the researchers used to push malware disguised as an application update. In a browser, where automatic downloads are not blocked, a shared chat containing a malicious preview was enough, and the victim did not even need a ChatGPT account.
The Electron-based ChatGPT Classic app was worse. There, Check Point found window.open worked with no user gesture at all, so simply holding a conversation could trigger exfiltration. The team demonstrated a malicious GPT silently sending chat messages to an attacker's server, and showed it could reload the main ChatGPT window and force the user to sign out, setting the stage for a fake re-login page that steals credentials. The attack could be delivered through a malicious prompt, a malicious GPT or a shared chat.
It is not the team's first look at ChatGPT's isolation. Earlier this year Check Point disclosed a DNS tunneling channel out of ChatGPT's code-execution runtime, and separate research showed how researchers made ChatGPT leak a victim's Gmail.
OpenAI closed the hole on September 18
Check Point reported the issue to OpenAI, which said on September 18, 2026 that it had deployed a fix by removing the allow-popups and allow-popups-to-escape-sandbox permissions from the outer HTML-preview iframe. Check Point retested and confirmed the technique no longer works. The research does not describe any setting users need to change, but it is a good reason to treat shared chats and GPTs from unknown sources with the same caution as any unfamiliar link, and to distrust any window inside an AI app that suddenly asks you to sign in again or install an update.
Check Point's own conclusion is the one worth keeping: every convenience feature added to an AI assistant widens its attack surface, and a protective mode is only as strong as the least-restricted feature it forgot to cover.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.