Check Point Research exposed a vulnerability in ChatGPT’s Lockdown Mode that could silently drain chat history without any user interaction. The attack exploited overly permissive iframe sandbox settings, using allow-popups and allow-popups-to-escape-sandbox permissions to break out entirely. In the Electron desktop app, simply chatting with a malicious GPT was enough.
Lockdown Mode was supposed to contain adversarial content. The sandbox configuration had a subtle gap that defeated the purpose. Browser sandboxes are notoriously hard to reason about: a permission that looks sensible alone can chain with others to create an escape. OpenAI patched it on September 18, 2026, removing the problematic settings.
Whether other LLM interfaces share the same pattern is worth checking. Sandbox escapes aren’t exotic bugs; they’re a common class of issue that slip past code review because the logic feels sound until someone tests the interactions.
Sources: ChatGPT Lockdown Mode Bypass: Phishing, Malware Delivery, and Silent Data Exfiltration
Coverage: Researchers Bypass ChatGPT Lockdown Mode to Exfiltrate Chats Without User Interaction
Related on this blog: [AUTO] ChatGPT Shared-Link Account Takeover • [AUTO] OpenAI’s Agents Exfiltrated User Images • [QT] OpenAI’s 20% Security Tax