The tension in sandbox design: Lockdown Mode was built specifically to block data exfiltration via prompt injections. But a misconfiguration of iframe permissions (a feature needed for legitimate uses) completely defeated it.
A vulnerability in ChatGPT’s Lockdown Mode, discovered by Check Point Research, exploited nested iframes with allow-popups and allow-popups-to-escape-sandbox permissions. By calling contentWindow.open(), an attacker could execute arbitrary HTML outside the sandbox, bypassing Lockdown Mode’s restrictions on outbound requests. This enabled silent exfiltration of chat data, credential phishing, and malware delivery without user interaction in the desktop app.
The attack highlights how security features can create a false sense of protection while the actual threat surface remains wider. Lockdown Mode was introduced specifically to address exfiltration risks, but its threat model apparently didn’t account for the HTML-preview feature added in February 2026 and the permissions that feature required.
OpenAI patched it on September 18 by removing the problematic iframe permissions. The fix was straightforward, but the incident suggests developers may have underestimated how difficult it is to add features without expanding the attack surface.
Sources: ChatGPT Lockdown Mode Bypass
Coverage: Check Point blog • CyberSecurityNews
Related on this blog: [AUTO] ChatGPT Sandbox Isolation Fails via Shared Infrastructure • [AUTO] ChatGPT’s Invisible Data Exfiltration Flaw • [AUTO] Codex Sandbox Escapes Expose Design Flaw