Researchers Bypass ChatGPT Lockdown Mode to Exfiltrate Chats Without User Interaction

Cybersecurity researchers have disclosed details of a now-patched vulnerability that could be exploited to bypass Lockdown Mode protections in OpenAI ChatGPT. Lockdown Mode was introduced by the artificial intelligence (AI) company in June 2026 as an optional setting to minimize data exfiltration risks arising from prompt injections. "The flaw could enable silent chat data theft, phishing, and malware delivery, including zero-click data exfiltration in the ChatGPT desktop application," Eli Smadja, head of research at Check Point, said in a report shared with The Hacker News. The problem stems from HTML page previews inside ChatGPT code blocks, which allow HTML content to be rendered directly within the application. Given that executing user-supplied HTML and JavaScript can introduce security risks of its own, the content is placed inside a sandbox so that it cannot access data from the app, such as cookies and local storage. The sandbox also prevents the rendered content from communicating with external resources without user consent. Lockdown Mode acts as a security barrier, mitigating data exfiltration risk by limiting outbound network requests that could be used to transfer sensitive information to an attacker-controlled infrastructure. However, Check Point found a loophole in the manner popup windows are handled during HTML previews that made it possible to escape the confines of the sandbox and bypass Lockdown Mode. "The HTML preview used nested sandboxed frames, and while ChatGPT intercepted direct attempts to open new windows, the underlying sandbox permissions still allowed popups and permitted them to escape the sandbox," Smadja explained. "By creating another nested frame within the rendered page, it was possible to access an unmodified popup function and bypass the restrictions placed on the original HTML preview. Content opened through this route was no longer subject to the same sandbox restrictions, providing a way to circumvent the protections of Lockdown Mode." Once the restrictions are bypassed, a threat actor can exploit the vulnerability to exfiltrate data, chat messages, or deliver malicious payloads by means of a crafted prompt, a malicious GPT, or a shared chat. What's more, as the attacker is in complete control of the content displayed in the popup window, it could be used to render convincing social-engineering lures, such as a fake ChatGPT update, and trick the victim into downloading malware by persuading them to click on a link. That said, the underlying issue is not limited to the Electron-based desktop environment, highlighting how weakness outside of the scope of the AI model can undermine AI security controls. Following responsible disclosure, the vulnerability was addressed by OpenAI on September 18, 2026. "Lockdown Mode was specifically intended to reduce the possibility of data leaving a conversation through potentially malicious outbound requests, yet a weakness in another application feature provided an alternative path around that security boundary," Smadja said. "The finding raises a broader enterprise security issue: AI security controls are only as strong as the wider application environment around them." The disclosure comes a week after Parameter Labs detailed a way to bypass ChatGPT's sandbox and content security policy (CSP) and take over anyone's account simply by sending an attacker-controlled public ChatGPT share link and prompting them to click the HTML preview once. If the HTML block is marked as previewable, it's opened automatically. "An attacker could create a malicious conversation, publish it using ChatGPT's normal sharing feature, and send the link to another user," security researcher Mukul Goyal said. "When the victim opened the share, the payload executed as chatgpt[.]com with access to the victim's authenticated web session." Earlier this September, Check Point also demonstrated a covert cross-account command channel through which an attacker could use a victim's ChatGPT session to run hidden tasks with the tools, data, and connected apps available to that session, alongside the visible conversation. "The victim could receive a normal answer to their visible request while the attacker's task was processed separately and its result returned across accounts," Check Point said. "The channel operated through code-execution environments belonging to different ChatGPT accounts." "The hidden instruction could be delivered through a malicious prompt, a shared ChatGPT conversation, or a custom GPT. Once it was present in the victim's conversation context, an ordinary message could trigger the attacker-controlled task without revealing it in the visible response." The findings coincide with the discovery of a number of security shortcomings in various AI-driven tools and services over the past few months to trick them into spilling secrets or carrying out unauthorized actions - An attack called SkillJacking that hijacks dependencies used by skills (repositories, packages, domains, or cloud apps) to compromise every agent installing them. A set of vulnerabilities in built-in browsers associated with five AI coding assistants, Cursor, GitHub Copilot, OpenAI Codex, Microsoft Visual Studio Code, and Anthropic Claude Desktop that could be exploited to execute code on a host machine, read and steal files, or spoof web browser address bars. The issues have been codenamed Embrace, short for EMbedded BRowser - Arbitrary Code Execution, Arbitrary Content Exfiltration, and Arbitrary Context Emulation. A technique called Repeat-After-Me that targets LangChain LangGraph, Microsoft Agent Framework, Microsoft AutoGen, Google Agent Development Kit 2.0, AWS Strands Agents, and CrewAI and tricks them into running tool calls by means of a "seemingly benign text-repetition request." A vulnerability called AgentCorruption that could allow an attacker to interact with an exposed AI agent running on AWS Bedrock AgentCore and leverage prompt injection techniques to influence that agent and extract its IMDS credentials, and then use them to access other agents, read private conversations, steal connected-tool credentials, and manipulate agent behavior. A vulnerability in SpaceXSI Grok and GitHub Copilot CLI called Cryptographic Context Injection that could be exploited to read a developer's local files and send them to an external server from a single web page via an indirect prompt injection, which hides malicious instructions inside AES-encrypted text. A zero-click vulnerability called SalesBleed that could be exploited to extract sensitive account data out of Salesforce Agentforce by leveraging the Web-to-Lead form to plant an indirect prompt injection payload. A proof-of-concept (PoC) attack called not-a-mused that allows an unprivileged local attacker (or process) to redirect Meta Muse's dictation traffic and abuse the permissions granted to the AI assistant to perform arbitrary actions. A zero-click vulnerability called Plugin4Shell that could be exploited to conduct an AI supply chain attack by silently swapping a trusted plugin with a malicious one while bypassing SHA pinning. "The agent checks out the exact commit the marketplace pinned but never verifies it landed there, so an attacker who controls the plugin's repo makes the checkout resolve to malicious code while the pin still looks honored," Air Security said. "The result is zero-click remote code execution across Claude Code, Codex, GitHub Copilot, and Gemini CLI." An attack called BragJack that can be exploited to hijack the AI agents built into browsers like Google Chrome, Microsoft Edge, Opera Neon, Perplexity Comet, and Anthropic Claude in Chrome by using an already installed malicious browser extension in conjunction with prompt forcing. A behavioral effect called sampling drift demonstrates how adding an invisible watermark to a large language model's (LLM) output can unintentionally change how the model behaves, including the tools an AI agent invokes, and likely weaken safety refusals. "Watermarking changes refusal behavior on bare harmful requests, but the effect is more pronounced when the same requests are paired with the prompt-injection technique," Lasso Security said. "On several models, watermarking then makes the model more likely to answer harmful requests that it would otherwise refuse." A set of attacks that exploit customer support AI agents to compose and send phishing emails, invoke tool calls, and bypass multi-factor authentication (MFA) protections. A prompt-crafting technique called PuzzleMask that bypasses quick LLM-based policy checks carried out by a lightweight gatekeeper model by planting the malicious instruction in a specially crafted prose wrapper, after which the payload is processed by a more powerful target model to trigger malicious actions. A technique called Workflow Identity Hijacking allows an attacker to bypass standard controls by sending normal, benign requests through an unauthenticated entry point, causing the enterprise AI pipeline to process the request and execute the action as designed. "The core failure is that the requester had no authority to make that request," Noma Security said. "When an AI workflow performs downstream actions, it executes using high-privilege service accounts or developer API keys rather than enforcing the permissions of the external user. As a result, AI workflows become unauthenticated proxies for privileged actions and silent data exfiltration." A zero-click vulnerability class called PleaseFix that could be exploited to hijack AI agents embedded in agentic browsers by placing malicious instructions inside emails, calendar invitations, or web pages, and exploit a technique referred to as intent collision to cause the agent to "act on the attacker's behalf using the user's own identity, permissions and access." A set of vulnerabilities impacting AI coding agents from Anthropic, Google, and OpenAI that could be exploited to trick them into handing over a victim's secrets, achieving persistent instruction poisoning by modifying the AGENTS.md file, and compromising software releases through prompt injections placed inside untrusted user inputs, like GitHub issues. "Agents are becoming the default infrastructure across CI/CD, messaging, triage, incident response, and support," Novee Security said. "The more autonomous they get, the more the harness decides what's safe on your behalf, and the more untrusted input reaches real execution." Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post.