Check Point Research has detailed a now-patched flaw in ChatGPT’s HTML preview feature that let content escape its sandbox and bypass Lockdown Mode, the optional setting OpenAI introduced to limit data theft through prompt injection. OpenAI fixed the problem in September, before the Nov. 5 disclosure, and no in-the-wild abuse has been reported.
How the HTML Preview Escaped Its Sandbox
Researcher Eli Smadja of Check Point Research disclosed the issue. ChatGPT can preview HTML inside code blocks, and the previews run in nested sandboxed frames. ChatGPT blocked direct calls that open new windows, but the sandbox permissions still allowed popups.
By creating another nested frame, the researchers gained access to an unmodified popup function. That access let the content escape the sandbox and operate outside the restrictions placed on it.
What Lockdown Mode Was Meant to Prevent
OpenAI introduced Lockdown Mode in June 2026 as an optional setting. It limits outbound requests from ChatGPT in order to reduce the chance that a prompt-injection attack can send user data to an attacker. The flaw let the preview content bypass that protection.
Consequences for ChatGPT Chat Data and Users
Check Point said the flaw could be used for silent theft of chat data, phishing and malware delivery. The firm’s description covers both the web version of ChatGPT and the legacy Electron desktop client.
Zero-Interaction Attack in the Desktop App
In the legacy Electron desktop application, the attack required no user interaction. Merely using a weaponized custom GPT could trigger it. Custom GPTs are user-built variants of ChatGPT, which means an attacker could publish one carrying the malicious HTML and wait for people to use it.
Check Point Disclosure and OpenAI’s September Fix
Check Point reported the flaw to OpenAI, which fixed it in September 2026. The fix came before the public disclosure, and the sources report no abuse in the wild. Because the fix was delivered before publication, the exposure described in the research relates to the period before the repair.
Scope of ChatGPT Exposure Before the Patch
The chat history and potentially other data of users who interacted with a malicious custom GPT or HTML content were exposed to the technique. The sources do not report any confirmed victims or any number of users affected.
Why the Bypass Matters for AI Safeguards
The finding shows that a protection built to restrict outbound requests depended on the sandbox around generated HTML holding up. The researchers’ route through nested frames undermined that assumption, and the result was a gap between the setting’s intent and its actual effect on the preview feature.
The Hacker News and SecurityOnline both reported the research. The coverage places the flaw within the broader category of sandbox escapes, where a feature meant to render untrusted content safely is given permissions, here popups, that can be chained into something more powerful.
Check Point’s account does not describe what data an attacker would have captured beyond chat contents, and it does not name the destination of any exfiltrated information. It does state that phishing and malware delivery were possible outcomes, which extends the risk beyond data theft to the user’s wider environment.
With the patch applied by OpenAI before disclosure, the technique described in the report no longer works against the affected components, according to the sources. The report remains a record of how a single permission in a nested frame could neutralize a dedicated lockdown feature.
Desktop Client and Custom GPT Exposure
The legacy Electron desktop client was the setting where Check Point described the most severe outcome. The attack required zero user interaction there, and using a weaponized custom GPT could be enough to trigger it. On the web version, the research describes the same sandbox escape through the HTML preview in code blocks.
Check Point reported the problem to OpenAI before publishing, and OpenAI completed its fix in September, ahead of the Nov. 5 disclosure by about two months. The research was reported by The Hacker News and SecurityOnline on the day of publication.
