Check Point Research published findings today on a bypass of ChatGPT’s Lockdown Mode, the optional setting OpenAI built to limit prompt-injection data theft.
CheckPoint researchers didn’t beat the AI controls, but found a way to go around them. A weakness in an ordinary app feature, HTML previews running in a sandbox, let content escape the restrictions Lockdown Mode is supposed to enforce. In the desktop app, the team showed a malicious GPT quietly leaking chat messages to an attacker-controlled server with no user click. They also showed a convincing fake “ChatGPT update” popup used to push malware.
OpenAI fixed it after responsible disclosure. It confirmed a fix on September 18, and Check Point retested and says the technique no longer works.
As assistants pick up code execution, file handling and connectors, the security of the AI depends on everything around the model: the apps, runtimes and sandboxes. Eli Smadja, Head of Research at Check Point Research, wrote the piece, and it argues that AI security controls are only as strong as the environment they sit in.
Full technical write-up from CPR: https://research.checkpoint.com/2026/chatgpt-lockdown-mode-bypass-phishing-malware-delivery-and-silent-data-exfiltration/
Related
This entry was posted on November 5, 2026 at 11:51 am and is filed under Commentary with tags Check Point. You can follow any responses to this entry through the RSS 2.0 feed.
You can leave a response, or trackback from your own site.
Check Point Research bypassed ChatGPT’s Lockdown Mode
Check Point Research published findings today on a bypass of ChatGPT’s Lockdown Mode, the optional setting OpenAI built to limit prompt-injection data theft.
CheckPoint researchers didn’t beat the AI controls, but found a way to go around them. A weakness in an ordinary app feature, HTML previews running in a sandbox, let content escape the restrictions Lockdown Mode is supposed to enforce. In the desktop app, the team showed a malicious GPT quietly leaking chat messages to an attacker-controlled server with no user click. They also showed a convincing fake “ChatGPT update” popup used to push malware.
OpenAI fixed it after responsible disclosure. It confirmed a fix on September 18, and Check Point retested and says the technique no longer works.
As assistants pick up code execution, file handling and connectors, the security of the AI depends on everything around the model: the apps, runtimes and sandboxes. Eli Smadja, Head of Research at Check Point Research, wrote the piece, and it argues that AI security controls are only as strong as the environment they sit in.
Full technical write-up from CPR: https://research.checkpoint.com/2026/chatgpt-lockdown-mode-bypass-phishing-malware-delivery-and-silent-data-exfiltration/
Share this:
Like this:
Related
This entry was posted on November 5, 2026 at 11:51 am and is filed under Commentary with tags Check Point. You can follow any responses to this entry through the RSS 2.0 feed. You can leave a response, or trackback from your own site.