"The flaw could enable silent chat data theft, phishing, and malware delivery, including zero-click data exfiltration in the ChatGPT desktop application," Eli Smadja, head of research at Check Point, wrote in a report shared with The Hacker News.
How HTML previews, sandboxes, and Lockdown Mode were supposed to work
ChatGPT's desktop application allowed HTML content to be rendered inside code-block previews. Because executing user-supplied HTML and JavaScript carries obvious risks, that content was placed inside a sandbox designed to block access to app data such as cookies and local storage and to prevent outbound network communications without user consent. In June 2026 OpenAI added Lockdown Mode as an optional setting specifically "to reduce the possibility of data leaving a conversation through potentially malicious outbound requests" that could be triggered by prompt injection.
The Check Point bypass: nested frames, popups, and the escape path
Check Point researchers discovered a loophole in the way the HTML preview handled popup windows. The preview used nested sandboxed frames and ChatGPT intercepted direct attempts to open new windows, but the underlying sandbox permissions still allowed popups and permitted them to escape the sandbox. By creating another nested frame inside the rendered page, an attacker could reach an unmodified popup function and open content that was no longer subject to the original sandbox restrictions, effectively bypassing Lockdown Mode's network restrictions.
Once that boundary was crossed, an attacker controlling the popup's content could exfiltrate chat messages or deliver malicious payloads via a crafted prompt, a malicious GPT, or a shared chat. The attacker also controlled what appeared in the escaped popup and could render social-engineering lures — for example a fake ChatGPT update — to trick a victim into downloading malware by clicking a link.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildConsequences described by researchers: silent exfiltration and zero-click risk
Check Point framed the vulnerability as enabling "silent chat data theft" and emphasized it could support phishing and malware delivery. The report notes the technique creates a pathway for data to leave a conversation without explicit user interaction beyond opening or rendering previewable HTML. The researchers tied this finding to a broader pattern: weaknesses outside the model — in the application environment and browser-like components — can undermine AI security controls.
Related bypasses and the broader pattern of AI platform weaknesses
The Check Point disclosure arrived a week after Parameter Labs published work demonstrating a different attack path to bypass ChatGPT's sandbox and content security policy. Parameter Labs showed that by sending an attacker-controlled public ChatGPT share link and prompting a user to click the HTML preview once, a payload could execute as chatgpt[.]com with access to the victim's authenticated session. "An attacker could create a malicious conversation, publish it using ChatGPT's normal sharing feature, and send the link to another user," security researcher Mukul Goyal said. When the HTML block was marked previewable, it opened automatically.
The Check Point disclosure sits alongside an array of recent findings that exploit the non-model components of AI systems: attacks such as SkillJacking, Embrace (vulnerabilities in embedded browsers for multiple coding assistants), Repeat-After-Me against agent frameworks, AgentCorruption on AWS Bedrock AgentCore, Cryptographic Context Injection in SpaceXSI Grok and GitHub Copilot CLI, zero-click SalesBleed in Salesforce Agentforce, not-a-mused against Meta Muse, Plugin4Shell supply-chain plugin-swapping, BragJack against browser-integrated agents, sampling drift from watermarking effects, PuzzleMask prompt-wrapping, Workflow Identity Hijacking in enterprise pipelines, and PleaseFix zero-click agent hijacks. Researchers and vendors named in those findings include Lasso Security, Air Security, Novee Security and others, all documenting how execution environments, dependencies, and workflow permissions create exploitable surfaces.
What this means for technologists, procurement leaders, and end users
- Technologists and security teams: Expect to re-evaluate not just model defenses like Lockdown Mode but also the browser-like components, HTML rendering, sandbox configuration, and popup handling in desktop and embedded clients. The Check Point finding shows a control in one layer can be circumvented by a weakness in another.
- Procurement and enterprise leaders: Assess vendor claims about "safe by default" features with an eye to the surrounding application environment; patches may close specific exploits, but the record in recent months shows many classes of non-model vulnerabilities that can undermine enterprise protections.
- End users and administrators: Be wary of previewable HTML in shared conversations and links that open automatic previews; researchers showed both crafted prompts and shared chats can carry payloads that run in preview contexts with surprising privileges.
OpenAI addressed the Check Point-disclosed vulnerability on September 18, 2026. As Smadja observed, "Lockdown Mode was specifically intended to reduce the possibility of data leaving a conversation through potentially malicious outbound requests, yet a weakness in another application feature provided an alternative path around that security boundary." The episode underscores a precise operational question for defenders: can model-level protections remain meaningful when the surrounding application stack exposes escape hatches? The record of recent research suggests the answer depends on rigorous hardening across every component that touches an AI session.
