Sensitive Business Conversations at Risk Following ChatGPT Lockdown Mode Bypass

Threat Category: AI Security | Data Exposure | Application Vulnerability
Affected Platform: OpenAI ChatGPT
Researcher: Check Point Research
Disclosure Date: 5 November 2026
Status: Patched

When a Security Feature Becomes the Target

Organisations increasingly use AI assistants to analyse documents, draft reports, process business information and support daily operations. As the volume of information shared with these tools grows, protecting conversations from unauthorised access becomes increasingly important.

This is why OpenAI introduced ChatGPT Lockdown Mode, an optional security feature designed to restrict external connections and reduce the risk of sensitive information being leaked through prompt injection attacks.

However, research discovered that these protections could be bypassed through a weakness in ChatGPT's HTML preview functionality. The vulnerability allowed malicious content embedded in HTML previews within code blocks to escape the application's security sandbox, creating an alternative route for accessing external resources.

The technique exploited how nested browser frames handled popup windows. By manipulating these popups, researchers were able to circumvent restrictions intended to prevent unauthorised communication with external destinations.

In a proof of concept involving the ChatGPT desktop application, researchers demonstrated that an attacker could silently extract conversation data without requiring user interaction. Other demonstrated attack scenarios included phishing and malware delivery through deceptive content displayed within the trusted ChatGPT interface.

OpenAI addressed the vulnerability on 18 September 2026, following responsible disclosure.

Why Should Organisations Pay Attention?

The incident highlights a security concern that extends beyond ChatGPT: AI applications can become repositories of sensitive corporate information, and weaknesses in their surrounding features can expose that information even when dedicated security controls are enabled.

For financial institutions, fintechs and other organisations using AI for research, documentation, customer support or internal productivity, exposed conversations could contain confidential business information, customer-related data, internal procedures or details of ongoing operations.

The potential consequences extend beyond data theft. Attackers could use information obtained from conversations to develop more convincing phishing campaigns, impersonate employees or distribute malicious files through interfaces users already trust.

The incident also reinforces an important point: enabling additional AI security restrictions does not eliminate the need for broader controls over what employees share with external AI platforms.

What Should Organisations Do?

• Review AI usage: Identify the AI platforms employees use and establish clear guidelines on the information that can be shared with them.

• Protect sensitive information: Restrict the submission of customer records, financial information, credentials, internal reports and other confidential business data to unapproved AI services.

• Control access: Apply appropriate access restrictions and organisational policies to approved AI platforms, particularly for employees handling sensitive information.

• Strengthen user awareness: Educate employees against trusting unexpected file downloads, update prompts or links presented within AI applications and shared conversations.

• Maintain application security: Keep ChatGPT desktop and browser applications updated and follow vendor security advisories as new vulnerabilities emerge.

Organisations should also recognise that this particular vulnerability has been patched. The recommended actions are intended to reduce exposure to similar AI application weaknesses, not to suggest that the disclosed bypass remains exploitable.

Strengthening AI Security Through Our MSSP Services

As organisations continue to adopt AI, it is important to understand the evolving risks that come with its use. This includes monitoring emerging AI-related attack techniques, investigating suspicious activity across endpoints, networks and user accounts, strengthening controls around application access and data exposure, and regularly assessing how well existing security measures can withstand AI-assisted attacks.

‍