# ChatGPT Lockdown Mode Bypass Let Attackers Copy Full Chat Histories

- URL: https://usa-24.com/chatgpt-lockdown-mode-bypass/
- Publisher: USA 24
- Section: Artificial Intelligence (AI)
- Published: 2026-11-06T18:13:40.468Z
- Updated: 2026-11-06T18:13:40.473Z
- Topics: ChatGPT, OpenAI, Cybersecurity, Prompt Injection, Data Privacy

> Check Point Research found a now-patched ChatGPT flaw that let attackers bypass Lockdown Mode, copy chat histories and push phishing pages. Here is what users should do now.

## Key takeaways

- Check Point Research published findings on November 5, 2026, describing a now-patched ChatGPT Lockdown Mode bypass that could silently copy a user's chat data.
- The flaw sat in ChatGPT's HTML preview feature, where a popup-handling loophole let an attacker escape the sandbox.
- In the ChatGPT Classic desktop app, simply having a conversation triggered the leak, according to GBHackers.
- Check Point said it saw no real-world attacks, and the sources conflict on whether OpenAI fixed the flaw in September 2026 or on September 18.
- Lockdown Mode is an optional setting, and the bypass means it should not be treated as a full guarantee for sensitive work data.

A now-patched ChatGPT Lockdown Mode bypass let attackers quietly copy a user's full chat history and, in some paths, deliver phishing forms or malware along the way. [Check Point Research](https://research.checkpoint.com/2026/chatgpt-lockdown-mode-bypass-phishing-malware-delivery-and-silent-data-exfiltration/) published the findings on November 5, 2026, and security outlets have been picking up the story since. Lockdown Mode is the optional setting OpenAI offers for people handling sensitive material, so the gap hits the users who expected the most protection.

The researchers did not need a victim to make a risky choice. Depending on the setup, a malicious prompt, a booby-trapped custom GPT or a shared chat could send conversation data to an attacker's server. OpenAI has since fixed the bypass, and Check Point said it saw no real attacks. The details still matter, because the flaw shows how a safety control can miss a feature that sits right beside it.

## How the ChatGPT Lockdown Mode bypass worked

The weakness lived in ChatGPT's HTML preview feature. According to [Cryptika](https://www.cryptika.com/hackers-could-bypass-chatgpt-lockdown-mode-to-steal-conversations-without-users-knowing/), OpenAI added an HTML preview to ChatGPT code blocks in February 2026. Check Point found a loophole in how popup windows were handled inside those previews, and that loophole let an attacker escape the sandbox meant to contain the content.

[The Hacker News](https://thehackernews.com/2026/11/researchers-bypass-chatgpt-lockdown.html) quoted the mechanism from Check Point's findings: “By creating another nested frame within the rendered page, it was possible to access an unmodified popup function.” Put simply, the attacker nested a frame inside the preview to reach a popup function that had never been changed to handle that case. Check Point's own write-up stated the problem more directly: “We found a vulnerability in ChatGPT that allowed an attacker to bypass Lockdown Mode.”

Once the sandbox was breached, the attacker could reach chat data. [GBHackers](https://gbhackers.com/chatgpt-lockdown-mode-bypass/) reported that a malicious prompt, a malicious custom GPT or a shared chat could each silently send chat messages to an attacker's server with no interaction. Cryptika added that the whole conversation and any uploaded files could be sent out. [SecurityOnline](https://securityonline.info/chatgpt-lockdown-mode-bypass/) also reported that the attack could deliver fake popups and credential-phishing forms.

The exposure differed by setting, as the reporting describes it:

| Setting | What the reporting describes |
|---|---|
| Browser, shared chat link | No account needed. Downloads are not blocked in a browser, so opening a shared chat link was enough. |
| ChatGPT Classic desktop app | Normal use was enough. Simply having a conversation triggered the leak. |
| Malicious prompt, custom GPT or shared chat | Could silently send chat messages to an attacker's server with no user interaction. |

## Why Lockdown Mode did not stop the attack

Lockdown Mode is designed to protect sensitive user data from prompt injection attacks that try to extract information. Prompt injection hides instructions in web pages, files or shared chats to get an assistant to leak data. When the setting is on, it restricts browsing to cached content, blocks web images, and turns off Canvas networking, Deep Research, Agent Mode, live connectors and file downloads, according to GBHackers.

The Hacker News reported that OpenAI introduced Lockdown Mode in June 2026. Check Point's write-up describes the feature only as recently introduced, so the timeline is not fully settled. Either way, the setting was built to stop this class of attack, and a bypass cuts against a feature sold for sensitive work.

A Greek analysis from [TheLab.gr](https://www.thelab.gr/news/%CE%B1%CF%83%CF%86%CE%AC%CE%BB%CE%B5%CE%B9%CE%B1/%CE%BA%CE%B5%CE%BD%CF%8C-%CF%83%CF%84%CE%B7%CE%BD-%CF%80%CF%81%CE%BF%CE%B5%CF%80%CE%B9%CF%83%CE%BA%CF%8C%CF%80%CE%B7%CF%83%CE%B7-html-%CF%84%CE%BF%CF%85-chatgpt-%CF%80%CE%B1%CF%81%CE%AD%CE%BA%CE%B1%CE%BC%CF%80%CF%84%CE%B5-%CF%84%CE%BF-lockdown-mode-r12644) makes the central point: Lockdown Mode correctly restricted the tools it controls but did not cover the separate HTML preview function. That is the pattern to watch. A safety switch protects the features its designers listed, and attackers look for the one nobody listed.

## Who is exposed and what remains unclear

Three groups carry the most risk. The first is US ChatGPT users who paste client records, financial details, medical notes or company material into chats. The second is anyone who opens shared chat links or runs third-party custom GPTs. The third is enterprises that relied on Lockdown Mode to meet compliance obligations.

Reporting points to the desktop app as the clearest exposure. Whether the web and mobile versions were affected is still unclear in the sources reviewed. Users weighing AI for money tasks face a related tradeoff. USA 24 recently looked at [Claude Personal Finance](https://usa-24.com/claude-personal-finance-bank-access/), which can read bank data but cannot move money, and the real question there is what an assistant can see.

## What to do now: steps for ChatGPT users

The reporting supports a short list of practical steps:

1. Keep the ChatGPT desktop app updated, as the reporting advises.
2. Keep medical, financial and work secrets out of chats unless the task truly requires them.
3. Treat shared chat links and third-party custom GPTs with caution, since clicking content in a shared chat could be dangerous, according to Check Point's guidance.
4. Do not treat Lockdown Mode as a full guarantee for sensitive data. This bypass defeated it.
5. If your team relies on Lockdown Mode for compliance, document the bypass and decide whether the setting still meets your requirements until a formal review is done.

## When OpenAI fixed the flaw and what is disputed

The fix date is not settled. [SecurityOnline](https://securityonline.info/chatgpt-lockdown-mode-bypass/) reports that OpenAI resolved the loophole in September 2026, and TheLab.gr gives September 18. The Hacker News calls the flaw now-patched without giving a date, so the exact day should be confirmed with OpenAI.

The remedy itself is specific. According to a [TLDR summary](https://tldr.tech/story/08de11a5-4c3e-49a3-af38-b0a57c36bfb9), OpenAI removed the problematic popup permissions from the outer sandbox iframe. [Wilson's Media](https://www.wilsonsmedia.com/ai-security-controls-are-only-as-strong-as-the-wider-application-environment-around-them-openai-forced-to-patch-after-experts-bypass-chatgpt-lockdown-mode-to-gain-access-to-entire-chat-history/) reports that, after Check Point disclosed its findings, OpenAI added safeguards to disable the Lockdown Mode workaround.

Several gaps remain. No CVE identifier or formal OpenAI advisory appeared in the sources reviewed, and USA 24 found no on-the-record OpenAI spokesperson statement in that material. [ProductNation](https://productnation.co/my/32269/chatgpt-lockdown-mode-bypass-check-point-PBGo/) reports that Check Point saw no real attacks, but that claim comes from a secondary source rather than Check Point's own write-up.

## Why this lands during the AI rules fight

The timing matters. Senators Cantwell and Rounds urged the White House to coordinate a federal response to AI-enabled cyber threats, and Democrats plan to introduce bills that would require independent testing of advanced AI systems, according to [Claims Journal](https://www.claimsjournal.com/news/national/2026/11/06/341154.htm). States are moving faster than Washington. According to the National Conference of State Legislatures, US states introduced 1,539 AI bills in 2026, up from 1,262 the previous year.

This is also not Check Point's first ChatGPT finding this year. In March, the team showed that DNS tunneling in ChatGPT's code runtime could send chat data to an outside server, according to Cryptika. Two disclosures in one year point to a moving attack surface, not a single bug. Defaults and settings are part of the trust problem too. USA 24 reported that an [OpenAI Codex training setting](https://usa-24.com/codex-training-setting-opt-out/) was reportedly turned back on without notice, which is a reminder that a control users rely on can change under them.

## What to watch next

Three things will show whether this flaw was a contained fix or a sign of a wider pattern. The first is OpenAI's written account of the fix, including the exact date and whether it assigns a CVE. The second is whether Lockdown Mode gets coverage for HTML previews and popup handling, the exact gap that Greek analysis identified. The third is whether the web and mobile versions were affected, which the reporting has not settled.

On the policy side, watch how the proposed bills on independent testing of advanced AI systems move once Democrats take control of Congress. A flaw like this one gives those proposals a concrete example. Security teams should expect more findings of this kind, and they should plan for a setting that protects data less completely than its label suggests.

## Frequently asked questions

### Was my ChatGPT chat history exposed by the Lockdown Mode bypass?

OpenAI has fixed the bypass, and Check Point said it saw no real-world attacks. Reporting says the desktop app was the clearest exposure, and shared chat links posed a risk in browsers. If you pasted sensitive material into chats during the exposure window, review what you shared and limit future uploads.

### What is ChatGPT Lockdown Mode?

Lockdown Mode is an optional ChatGPT setting designed to protect sensitive user data from prompt injection attacks that try to extract information. When it is on, it restricts browsing to cached content, blocks web images, and turns off Canvas networking, Deep Research, Agent Mode, live connectors and file downloads. The Hacker News reports that OpenAI introduced it in June 2026.

### Do I need to update ChatGPT to stay protected?

The reporting advises keeping the ChatGPT desktop app updated. The sources reviewed do not include a CVE or a formal OpenAI advisory, so there is no published version number to check against. Install available updates through the app's normal update path.

### Could this bug be used to deliver malware?

Check Point's research describes phishing and malware delivery as part of the attack paths. SecurityOnline reported that the attack could deliver fake popups and credential-phishing forms. The sources reviewed show no confirmed real-world abuse.

## Sources

1. [ChatGPT Lockdown Mode Bypass: Phishing, Malware Delivery, and Silent Data Exfiltration — Check Point Research](https://research.checkpoint.com/2026/chatgpt-lockdown-mode-bypass-phishing-malware-delivery-and-silent-data-exfiltration/)
2. [Researchers Bypass ChatGPT Lockdown Mode to Exfiltrate Chats Without User Interaction — The Hacker News](https://thehackernews.com/2026/11/researchers-bypass-chatgpt-lockdown.html)
3. [ChatGPT Lockdown Mode Bypass Allowed Hackers to Steal Private Chats Without User Interaction — GBHackers](https://gbhackers.com/chatgpt-lockdown-mode-bypass/)
4. [Hackers Could Bypass ChatGPT Lockdown Mode to Steal Conversations Without Users Knowing — Cryptika](https://www.cryptika.com/hackers-could-bypass-chatgpt-lockdown-mode-to-steal-conversations-without-users-knowing/)
5. [ChatGPT Lockdown Mode Bypass Exposes Chat Data — SecurityOnline](https://securityonline.info/chatgpt-lockdown-mode-bypass/)
6. [ChatGPT Lockdown Mode Bypass: Phishing, Malware Delivery…— TLDR](https://tldr.tech/story/08de11a5-4c3e-49a3-af38-b0a57c36bfb9)
7. [ChatGPT Lockdown Mode Bypass Found by Check Point — ProductNation](https://productnation.co/my/32269/chatgpt-lockdown-mode-bypass-check-point-PBGo/)
8. [OpenAI forced to patch after experts bypass ChatGPT 'lockdown mode' — Wilson's Media](https://www.wilsonsmedia.com/ai-security-controls-are-only-as-strong-as-the-wider-application-environment-around-them-openai-forced-to-patch-after-experts-bypass-chatgpt-lockdown-mode-to-gain-access-to-entire-chat-history/)
9. [Κενό στην προεπισκόπηση HTML του ChatGPT παρέκαμπτε το Lockdown Mode — TheLab.gr](https://www.thelab.gr/news/%CE%B1%CF%83%CF%86%CE%AC%CE%BB%CE%B5%CE%B9%CE%B1/%CE%BA%CE%B5%CE%BD%CF%8C-%CF%83%CF%84%CE%B7%CE%BD-%CF%80%CF%81%CE%BF%CE%B5%CF%80%CE%B9%CF%83%CE%BA%CF%8C%CF%80%CE%B7%CF%83%CE%B7-html-%CF%84%CE%BF%CF%85-chatgpt-%CF%80%CE%B1%CF%81%CE%AD%CE%BA%CE%B1%CE%BC%CF%80%CF%84%CE%B5-%CF%84%CE%BF-lockdown-mode-r12644)
10. [Democrats Planning Flood of AI Bills When They Take Control of Congress — Claims Journal (Courtney Rozen)](https://www.claimsjournal.com/news/national/2026/11/06/341154.htm)