Check Point Finds Way Around ChatGPT's Lockdown Mode, Raising Phishing and Data Leak Risks

Check Point Research has disclosed a vulnerability in ChatGPT that allowed an attacker to bypass Lockdown Mode, an optional security setting from OpenAI. Lockdown Mode is designed to reduce the risk of prompt injection, where an attacker tricks the AI into making outbound requests that carry private data to a server they control. It does this by cutting off the channels data could leave through: live web access is limited to cached content, internet images are blocked, network requests from Canvas code are disabled, and Deep Research, Agent Mode, live connectors and file downloads are switched off.

According to the researchers, the flaw allowed covert exfiltration of chat data to an external server even with these protections in place. The impact was not limited to data leakage. The vulnerability also allowed manipulation of the ChatGPT Classic interface, including popup windows showing arbitrary content, which opens the door to a range of phishing attacks. The attack could be delivered through a malicious prompt, a malicious GPT, or a shared chat.

The issue relates to an HTML page preview feature that OpenAI added to ChatGPT code blocks in February 2026. The source notes that safeguards surround this feature, because rendering user-controlled HTML inside the interface could otherwise create a direct path for private data to leak. This article covers only the opening of Check Point's research, which goes on to give technical details and exploitation scenarios. The same researchers earlier reported a separate flaw, since fixed, that leaked conversation data through DNS tunneling.