When an AI vendor adds a "lockdown mode," it's admitting what we all know: prompt injection isn't solved, so the next best thing is limiting what a hijacked assistant can do. Which makes it a pretty big deal when the lockdown has a hole in it.
What Happened
On November 5, Check Point Research published a bypass of ChatGPT Lockdown Mode, the optional setting OpenAI introduced in June. OpenAI says Lockdown Mode is meant to "reduce the risk that a prompt-injection attack can exfiltrate sensitive data." It does that by blocking outbound requests: cached-only web access, no internet images, no network requests from Canvas, and no Deep Research, Agent Mode, live connectors or file downloads.
Check Point found a way out anyway, through HTML previews in code blocks.
How It Worked
The HTML preview runs inside two nested sandboxed iframes. The outer one allowed popups and allowed those popups to escape the sandbox. ChatGPT overrode window.open to stop direct attempts, but a nested frame's own open function wasn't filtered. Open a popup from there, and it runs attacker-controlled HTML outside the sandbox, with network access Lockdown Mode was supposed to remove.
Check Point says the result could be silent theft of full chat history, phishing popups, malware delivery dressed up as an app update, and forced sign-outs leading to credential phishing. In the Electron-based ChatGPT Classic desktop app, window.open worked without a user gesture, so exfiltration was zero-click. The attack could arrive through a crafted prompt, a malicious GPT or a shared chat.
The Good News
It's fixed. Check Point says OpenAI told them on September 18 that it had deployed a fix by removing the two popup permissions from the outer iframe, and Check Point retested and confirmed the technique no longer works. No in-the-wild exploitation has been reported. Credit to both sides for doing this the right way.
Why It Still Matters
This is the AI security version of an old lesson: a feature you bolt onto the side of an application (HTML previews) can quietly undo a security control you bolted on elsewhere (Lockdown Mode). The control was defined as "no outbound requests," and the preview feature had its own path to the network that nobody connected to that promise.
For enterprises, the takeaway isn't "ChatGPT is unsafe." Every AI assistant has had a finding like this, and there will be more. The takeaway is not to rely on one in-app setting as your only data protection. (Usual disclosure: I work at Zscaler, which sells controls in this space, so weigh my bias.) Controls that sit outside the app, on what data goes into AI tools and where those sessions can send traffic, still hold when an in-app control breaks.
What To Do
- Keep desktop AI apps updated, and retire old builds like the Classic app if you can. The zero-click path lived there.
- Be suspicious of shared chats and custom GPTs from outside your organization. They were delivery vehicles here.
- Treat Lockdown Mode as one layer, not the plan. Decide what data is allowed into AI assistants at all, and enforce it with DLP.
- Watch for "update" prompts inside AI tools. A popup asking you to install something from a chat is a red flag, not a feature.
- Inventory where AI assistants run in your environment, including desktop apps and browser extensions, so you can respond when the next one lands.
Bottom Line
Lockdown Mode is a good idea that had a side door, and it's closed now. The lesson is bigger than this bug: in-app AI guardrails will keep failing in creative ways, so put your data controls somewhere the prompt can't reach.
Sources: Check Point Research, Check Point blog, OpenAI on Lockdown Mode, and The Hacker News