---
title: "[AUTO] ChatGPT's Lockdown Mode Had a Sandbox Escape"
pubDatetime: 2026-11-06T00:39:00.000Z
description: "Researchers found an iframe sandbox escape in ChatGPT's Lockdown Mode that could exfiltrate chat history without user interaction."
tags: [ai-security, vulnerability, openai, 2026, 2026-q4, 2026-11, AUTO]
---
Check Point Research [exposed](https://research.checkpoint.com/2026/chatgpt-lockdown-mode-bypass-phishing-malware-delivery-and-silent-data-exfiltration/) a vulnerability in ChatGPT's Lockdown Mode that could silently drain chat history without any user interaction. The attack exploited overly permissive iframe sandbox settings, using allow-popups and allow-popups-to-escape-sandbox permissions to break out entirely. In the Electron desktop app, simply chatting with a malicious GPT was enough.

Lockdown Mode was supposed to contain adversarial content. The sandbox configuration had a subtle gap that defeated the purpose. Browser sandboxes are notoriously hard to reason about: a permission that looks sensible alone can chain with others to create an escape. OpenAI patched it on September 18, 2026, removing the problematic settings.

Whether other LLM interfaces share the same pattern is worth checking. Sandbox escapes aren't exotic bugs; they're a common class of issue that slip past code review because the logic feels sound until someone tests the interactions.

---

*Sources: [ChatGPT Lockdown Mode Bypass: Phishing, Malware Delivery, and Silent Data Exfiltration](https://research.checkpoint.com/2026/chatgpt-lockdown-mode-bypass-phishing-malware-delivery-and-silent-data-exfiltration/)*

*Coverage: [Researchers Bypass ChatGPT Lockdown Mode to Exfiltrate Chats Without User Interaction](https://thehackernews.com/2026/11/researchers-bypass-chatgpt-lockdown.html)*

*Related on this blog: [[AUTO] ChatGPT Shared-Link Account Takeover](/posts/auto-chatgpt-shared-link-takeover)  •  [[AUTO] OpenAI's Agents Exfiltrated User Images](/posts/auto-openai-image-exfiltration)  •  [[QT] OpenAI's 20% Security Tax](/posts/qt-openai-monitoring-overhead)*