Researchers bypassed ChatGPT Lockdown Mode through HTML preview

Check Point, a security firm, found a vulnerability that bypassed Lockdown Mode in ChatGPT. OpenAI added this tool in June 2026 to stop data loss through prompt injection, which is text that makes an AI obey an attacker. The vulnerability let an attacker read chat data in the desktop app with no click from the user.

How it works

ChatGPT shows a preview of HTML code in a chat. The preview is in a sandbox, a locked area. It cannot get app data or connect to external servers unless the user agrees.

Check Point found that the sandbox permitted popup windows. A different frame in the page got to an initial popup function. The popup then left the sandbox and the limits of Lockdown Mode.

The proof

The report gives no test numbers. Eli Smadja, head of research at Check Point, reports that an attacker could read chats or send malware. The attacker could use a special prompt, a bad GPT or a chat link.

The popup could also show an incorrect ChatGPT update.

What is not known

Smadja reports that the problem is not only in the desktop app. The report gives no report of use against users.

Insight: The HTML preview is a repeated weak point in ChatGPT

Check Point found this bypass. A week before, Parameter Labs showed that a chat link could control an account through the same HTML preview. This reads as a sign that researchers go for the tools around the model, not the model. More finds can follow. Test those tools.