Check Point bypassed ChatGPT Lockdown Mode with a popup from a nested iframe

On November 5, Check Point Research published details of a bypass of ChatGPT’s Lockdown Mode, the setting OpenAI built specifically to stop prompt injection from leaking data. Researcher Alexey Bukhteyev found that ChatGPT’s HTML page preview could be made to open a real browser window outside its sandbox. From there, attacker-controlled code could send chat content to an outside server, show phishing pages under ChatGPT’s icon and push malware. In one desktop client, no click was needed.

OpenAI told Check Point on September 18 that a fix was deployed, and retesting confirmed the technique no longer works, so nobody needs to act today. The case matters for a different reason: it shows how a hardened mode can be defeated by a feature that shipped alongside it, through a mistake that anyone embedding untrusted HTML can make. The write-ups we read mention no CVE and no exploitation in the wild, and neither includes a comment from OpenAI.

Two features, shipped the same month

OpenAI introduced Lockdown Mode on February 13, initially for enterprise, education, healthcare and teacher plans, and has since widened access. It restricts browsing to cached content, blocks web images, and disables Deep Research, Agent Mode and file downloads, along with network access for Canvas-generated code. The logic is sound: if injected instructions cannot reach the network, they cannot exfiltrate anything. OpenAI itself says the mode reduces the risk rather than eliminating it.

In the same month, ChatGPT gained HTML page preview for code blocks. That is an execution environment for model-written markup, which means it is also a potential outbound channel. OpenAI did contain it, with two nested sandboxed iframes that blocked access to the parent page, cookies and localStorage, and that intercepted outbound requests, images, links and popups behind user approval prompts. The defense had one structural weakness.

How the bypass worked

The outer iframe’s sandbox attribute included two permissions: allow-popups and allow-popups-to-escape-sandbox. The second is the dangerous one. Under the HTML standard, it means a popup does not inherit the sandbox of the page that opened it.

Since the browser would permit escaping popups, OpenAI blocked them a layer up, in JavaScript. The sandbox script replaced window.open with a function that routed the request to a user approval prompt and returned null. Calls with an empty URL or about:blank simply returned null.

The problem is that window.open is not one function. Every browsing context has its own window object with its own copy, and a page can create new contexts at will. Check Point’s proof reduces to this contrast:

window.open("about:blank");                 // blocked by the override
const f = document.createElement("iframe");
document.body.appendChild(f);
f.contentWindow.open("about:blank");        // works

(The two open calls and their outcomes are Check Point’s; the setup lines are ours, for readability.)

The override patched the top-level page only. A freshly created child iframe carried the original native function, and the browser’s permissions still allowed the popup. Once a real window existed, the attacker could write arbitrary HTML into it, and that code no longer ran in the sandbox. The request interception and the Lockdown Mode restrictions both stopped applying.

Check Point lists three delivery routes: a malicious prompt, a malicious GPT or a shared chat. It does not spell out the full exfiltration flow. The natural reading is that a model under injected instructions can write conversation content into the page it generates, which is why controlling the network is the whole game once injection has succeeded.

What an attacker could do

• Silent exfiltration. Check Point demonstrates a malicious GPT leaking chat messages to an attacker’s server without notification.
• Zero-click theft in ChatGPT Classic. Browsers normally require a user gesture before opening a window. In the Electron-based Classic desktop app, window.open worked without one, so having the conversation was enough.
• Phishing. The popup kept ChatGPT’s icon with an attacker-chosen title. In Classic, researchers could also reload the main window and force a sign-out, setting up a fake re-login page.
• Malware. A popup could present a payload as a ChatGPT update. The desktop app blocks automatic downloads, but browsers do not, and a shared chat could reach people who have no ChatGPT account.

The Electron finding deserves its own attention. Teams often treat a desktop wrapper as the same security surface as the website. Here, removing the user-gesture requirement turned a one-click issue into a zero-click one. The bug was the same, and the host changed its severity.

Why this matters beyond one patched bug

OpenAI’s fix was to delete both permissions from the outer iframe. That is the correct fix, and it carries the main lesson.

Enforce at the browser boundary, not in the guest. Script running inside a sandbox cannot reliably police other script running there. Overriding a dangerous API is a speed bump, because the guest can reach a clean copy through a new iframe. If a capability must not be used, the sandbox attribute and the Content Security Policy should deny it. If approved popups are a product requirement, the approval needs to live outside the sandboxed frame, and escaping popups should not be granted at all.

A hardened mode has to enumerate every egress path, including future ones. Lockdown Mode is a list of disabled features. Any new feature that can execute content or reach the network silently extends the attack surface unless a release check forces the question. This is the second time Check Point has found a channel around ChatGPT’s containment this year, after an earlier DNS tunneling issue in the code execution runtime. Its team has also shown weaknesses in Jev’s typed decision model. The pattern is consistent: the model’s refusal behavior is not what fails. The leak is a side door in the surrounding product.

Test each host separately. Web, Electron and mobile clients enforce different gesture, download and window rules. A security review of the web app does not transfer.

Check Point’s own closing advice is general: treat assistant features as parts of one platform, and be careful about the sensitive data and computer access given to AI tools. That advice lands harder because of who opts into Lockdown Mode. It exists for people who believe they are targets, so a bypass hits the users with the most to lose, while they believe they have the strongest protection in the product.

What to watch

Check Point’s post does not say when it reported the flaw, or when the vulnerable configuration first went live. If it dates to the preview feature’s February debut, the exposure could have run about seven months. An OpenAI statement on the window, and on whether logs show any abuse, would settle that.

For teams running ChatGPT under Lockdown Mode, the useful follow-up is a question to your OpenAI contact: is HTML preview, and any feature added after it, explicitly covered by Lockdown Mode’s review process? For teams building their own agent products, grep your codebase for allow-popups-to-escape-sandbox today.