Researchers Bypass ChatGPT Lockdown Mode to Exfiltrate Chat Data
A critical vulnerability allowed attackers to escape sandboxes and bypass ChatGPT's security protections.
1Lockdown Mode Security Flaw
Cybersecurity researchers identified a vulnerability in OpenAI's ChatGPT that bypassed the platform's Lockdown Mode. Introduced in June 2026, this feature was designed to prevent data exfiltration by restricting outbound network requests. However, a flaw in how the application handled HTML page previews allowed attackers to circumvent these critical security boundaries entirely.
2Sandbox Escape Mechanism
The issue originated from the rendering of HTML content within code blocks. Although ChatGPT uses a sandbox to isolate this content, researchers discovered that nested frames could be exploited. By creating a new frame within the preview, attackers accessed an unmodified popup function, effectively escaping the sandbox and neutralizing the Lockdown Mode protections.
3Silent Data Exfiltration Risks
Once the sandbox was bypassed, attackers could perform silent data theft or deliver malicious payloads without user interaction. The vulnerability enabled the execution of zero-click exfiltration, where sensitive chat history or user data could be transferred to external infrastructure. This process occurred silently, leaving the victim unaware that their private session was compromised.
4Social Engineering and Malware
Beyond data theft, the flaw allowed attackers to render deceptive content within popup windows. By displaying convincing lures, such as fake software updates, threat actors could trick users into clicking malicious links. This technique facilitated the delivery of malware, turning the AI interface into a vector for traditional cyberattacks against unsuspecting users.
5Patching and Remediation Efforts
Following responsible disclosure by Check Point researchers, OpenAI addressed the vulnerability on September 18, 2026. The fix focused on closing the loophole that allowed nested frames to escape the established sandbox environment. This update was necessary to restore the integrity of the Lockdown Mode feature and protect users from potential exploitation.
6Broader AI Security Implications
This incident highlights that AI security controls are only as robust as the surrounding application environment. Even with sophisticated model protections, vulnerabilities in auxiliary features like HTML previewers can undermine the entire security posture. The discovery emphasizes the need for comprehensive security audits that extend beyond the core AI model architecture.
7Recent Pattern of Vulnerabilities
This discovery follows other security shortcomings identified in various AI tools recently. Earlier in September 2026, researchers demonstrated methods to bypass content security policies and take over accounts via shared links. Additionally, experts uncovered covert command channels that allowed attackers to run hidden tasks within a victim's active ChatGPT session without their knowledge.
8Future of Autonomous Agents
As AI agents become default infrastructure for tasks like incident response and support, the risks associated with untrusted input increase. Security experts warn that as these systems gain more autonomy, the importance of rigorous input validation and sandbox isolation grows. Organizations must prioritize visibility into AI identities to mitigate these emerging threats.
Original article: The Hacker News — Researchers Bypass ChatGPT Lockdown Mode to Exfiltrate Chat Data