Security firm reports bypassing ChatGPT 'Lockdown Mode' to access chat history; OpenAI patches flaw

Researchers from US cybersecurity firm Check Point Research (CPR) discovered a method to bypass OpenAI ChatGPT's 'Lockdown Mode', a feature designed to protect users from prompt injection attacks by restricting external connections and disabling certain functions. The researchers exploited a flaw in the nested sandboxed frames used for HTML previews within code blocks, allowing popups to escape sandbox restrictions and potentially access the entire chat history.

'Lockdown Mode' was originally designed to reduce the risk of sensitive data exposure via prompt injection by limiting features like live web browsing, Deep Research, Agent Mode, and file downloads. However, CPR noted that while ChatGPT intercepted direct attempts to open new windows, the underlying sandbox permissions still allowed popups to exist and escape. By creating nested frames, the researchers could access unmodified popup functions, bypassing all restrictions placed on the original HTML preview.

This vulnerability could lead not only to data theft but also to malware deployment, phishing attacks, or credential theft. The most dangerous scenario described was a 'zero-click' attack, where the popup appears without user interaction. CPR emphasized that 'AI security controls are only as strong as the wider application environment around them,' indicating that model-level security measures alone are insufficient and enterprises must consider the overall attack surface comprising applications, runtimes, and connectors.

OpenAI implemented additional safeguards server-side after receiving the disclosure to disable this workaround. Although the vulnerability has been patched, the incident serves as a reminder for users and organizations to remain vigilant about application-layer security boundaries when handling sensitive information with AI tools and to seek greater visibility into AI usage.