ChatGPT’s Lockdown Mode Had a Bypass, Check Point Finds

Check Point Research has disclosed a vulnerability that let attackers get around Lockdown Mode, a security setting in ChatGPT built specifically to block the kind of prompt-injection attacks used to steal data from a user’s chat.

How the bypass got around Lockdown Mode

Lockdown Mode is meant to make data exfiltration much harder by cutting off the usual outbound channels: live web access, internet-hosted images and Canvas network requests, while also switching off Deep Research, Agent Mode, live connectors and file downloads. Check Point’s researchers found that a separate part of the app, the HTML page-preview sandbox used to render HTML content, still kept popup permissions open, and that these were reachable through nested frames. A malicious prompt, a malicious GPT or a shared chat could all trigger the technique, depending on the scenario.

A zero-click leak in the desktop app

In the Electron-based ChatGPT desktop app, the popup behaviour worked without any user gesture at all. Check Point demonstrated a malicious GPT silently leaking chat messages to an attacker-controlled server while the victim was still in the middle of a conversation, which makes it a potential zero-click data-exfiltration scenario. The same kind of pop-up could also keep ChatGPT’s own app icon while showing attacker-controlled titles and content, making a phishing attempt or a fake update prompt look like it was coming from an interface the user already trusts. Check Point also demonstrated a credential-theft scenario, where the main application window was manipulated to send a signed-out user to an attacker-controlled login page. Malware delivery through the desktop app wasn’t zero-click, though — the victim would still have had to click a link to download a file.

“As AI assistants evolve from simple chatbots into connected platforms that can access data, run code and interact with other systems, they are also creating new paths for attackers that traditional security models were never designed to address,” said Pedro Drimel Neto, Malware Analyst, Team Lead, Check Point Research. “This research is a reminder that securing AI cannot stop at the model or rely on a single protective control — organizations need visibility into how AI is being used, strong limits around sensitive data and access, and layered security across the entire AI environment. The goal is not to slow AI adoption, but to make sure security evolves just as quickly as the technology and the new attack surface it creates.”

Already fixed, Check Point says

OpenAI removed the sandbox permissions that allowed the technique after Check Point disclosed it. Check Point says it retested the exploitation method it describes and confirmed it no longer works, and found no evidence the vulnerability had been used in the wild before the fix went in.

A lesson that goes beyond one fix

Check Point’s broader point is that a security control built to contain the fallout of prompt injection can still be undermined by a weakness somewhere else in the same platform. AI assistants now combine models with browser and desktop apps, content-rendering layers, sandboxes, code-execution environments, files, connectors and external services, and each of those pieces can have its own protections that don’t necessarily add up to one coherent line of defence. Check Point’s advice to enterprises is to treat no single “restricted” or “lockdown” mode as a complete security boundary — instead keeping visibility into how staff are actually using AI tools, limits on what sensitive data reaches them, and ongoing retesting as platforms add new features and integrations.