ChatGPT Lockdown Mode Bypass Could Leak Your Chat History Without Your Knowledge

Security researchers at Check Point Research discovered a vulnerability in ChatGPT that allows an attacker to bypass the heightened security of Lockdown Mode and leak your entire chat history with zero user interaction.

Lockdown Mode is a setting you can enable in ChatGPT to limit "to the web and external services to help reduce data exfiltration risk from prompt injection attacks."

The setting works on a similar idea to Apple's Lockdown Mode: it disables features that pose a security risk to defend against potential exploits. However, OpenAI's Lockdown Mode is specifically designed to prevent data exfiltration from prompt injection attacks.

These attacks exploit an inherent security flaw in AI chatbots: they can't tell the difference between instructions and input. In other words, they inherently can't tell the difference between what they were originally told to do and what the user is telling them to do right now.

Instead, they rely on training and guardrails in order to distinguish the difference, but it's a cat-and-mouse game. A malicious actor can find a way around the guardrails and instruct the bot to send sensitive data off to them, for example.

But if the model can't exfiltrate data out of the chatbot, then even if a prompt injection attack occurs, the private data of the user is safe theoretically. This is the idea behind Lockdown Mode.

Check Point found a way around Lockdown Mode using the HTML preview feature added back in February 2026.

OpenAI attempted to protect the feature by implanting guardrails and sandboxing the URLs in iframes. But, they gave them permissions such as allow-popups and allow-popups-to-escape-sandbox.

An attacker can open a popup, which will not be executed in the sandbox, and place any arbitrary HTML code in it.

This vulnerability opens a wide attack surface. It could enable the covert theft of entire chat history and uploaded files, the distribution of malware disguised as a legitimate update, and even credential theft.

Check Point Research says they disclosed the vulnerability to OpenAI in September and OpenAI has deployed a fix by removing the allow-popups and allow-popups-to-escape-sandbox permissions from the iframes.

Check Point had previously discovered another data leak in ChatGPT using a single malicious prompt using DNS to exfiltrate user data.