al-ice.ai

The Popup That Left the Sandbox: Check Point Bypassed ChatGPT Lockdown Mode

Agent & Supply Chain Security by al-ice.ai Editorial

On 5 November 2026, Check Point Research published a bypass of the strongest anti-exfiltration control OpenAI ships to consumers. Lockdown Mode — the optional setting we covered at launch that cuts the outbound channels prompt injection needs (live web reduced to cached content, remote images blocked, Canvas network requests disabled, Deep Research, Agent Mode, live connectors and file downloads switched off) — could be defeated end-to-end by a popup. Researcher Alexey Bukhteyev showed that the HTML page preview feature’s sandbox carried two permissive tokens, allow-popups and allow-popups-to-escape-sandbox, and that a nested iframe handed attacker content a genuine window.open. The resulting window rendered arbitrary HTML outside the sandbox — and therefore outside everything Lockdown Mode restricts. The demonstrated outcomes were silent theft of entire chat history, malware delivery from a spoofed ChatGPT window, and credential theft, with a zero-click variant in the ChatGPT Classic desktop app. Check Point disclosed responsibly; OpenAI removed the two sandbox tokens on 18 September 2026, and Check Point retested and confirmed the technique no longer works.

One real window.open behind two layers of sandbox

The feature that created the hole arrived in February 2026: HTML page previews inside ChatGPT code blocks, rendering user-controlled HTML with JavaScript. The design anticipated the danger — rendered pages sit in two nested iframes, isolated from the parent document, the ChatGPT UI state, and chatgpt.com cookies and localStorage, with approval dialogs intercepting external images, scripts, links and outbound URLs. The popup path looked covered too: the sandbox redefines window.open into an approval-gated stub that returns null for empty or about:blank targets. But the iframe sandbox itself was not asked to forbid popups — the allow-popups token was present — so attacker JavaScript could create one more nested iframe and call its contentWindow.open, which is the browser’s real implementation, never stubbed. Combined with allow-popups-to-escape-sandbox, the opened window runs attacker HTML free of every sandbox restriction and every Lockdown Mode channel cut. It is a textbook confused deputy at the seam between two enforcement layers: the stub policed the front door while the sandbox tokens left the side door signed open.

What the escaped window could do

Check Point walks four scenarios, and each exploits a different property of the escaped context. Silent exfiltration: the unsandboxed page could ship entire chat history and uploaded files to an attacker server with no notification — the exact outcome Lockdown Mode exists to prevent, demonstrated on video. Malware delivery: the popup retains the ChatGPT application icon while its title is attacker-controlled, so a “Download ChatGPT update” lure arrives wearing the trusted application’s face; in a browser, automatic downloads are not blocked, and a shared chat carrying the malicious preview endangers recipients who never had an account. Credential theft: the researchers could reload content in the main application window and act on the user’s behalf, including forcibly signing them out — the setup for a re-authentication lure on an attacker page. And zero-click in Classic: in the Electron-based ChatGPT Classic client, window.open fires without a user gesture, so merely conversing with a malicious GPT was enough to trigger silent leakage, no click required. The delivery vectors multiply the reach: a malicious prompt, a malicious GPT, or a shared chat.

A second CPR find in the same attack surface, fixed the same way

This is Check Point’s second disclosure in ChatGPT’s execution-and-rendering layer this year. Earlier, the same team found sensitive conversation data leaving the code-execution runtime through DNS tunneling past network isolation; OpenAI fixed that promptly. Both episodes point the same direction, and the researchers say it outright: as assistants become full execution environments — running code in the cloud, rendering attacker-influenced content on the client, handling medical, financial and credential material — every convenience capability quietly widens the exfiltration surface, including features built purely for preview comfort. The fix here is correspondingly structural rather than behavioral: no new user warning, no new consent dialog — the two sandbox tokens are simply gone from the outer preview iframe. Note the timeline honestly: the vulnerability lived from the preview feature’s February debut until the 18 September fix, and publication followed on 5 November. Anyone reconstructing exposure windows for sensitive chats should use February-to-September, not the disclosure date.

What to actually do

  1. No user action is required for this specific flaw — the fix is server-side and confirmed — but treat shared chats and third-party GPTs as untrusted HTML delivery going forward: the next preview-layer bug will arrive through the same vectors (malicious prompt, malicious GPT, shared chat).
  2. Keep Lockdown Mode on for sensitive work, without treating it as a guarantee. It raises the cost of exfiltration substantially; this bypass proves a single sandbox-token misconfiguration could zero it out. Defense in depth means pairing it with data minimization — what was never pasted cannot be exfiltrated.
  3. If your threat model includes targeted phishing, assume chat content discussed with AI assistants before mid-September 2026 was within the exposure window for this class, and weigh that in credential-rotation and pretexting-awareness decisions.
  4. For builders: audit sandbox tokens against the enforcement you assume. If your code stubs window.open, your iframe must not carry allow-popups; if your threat model needs containment, it must not carry allow-popups-to-escape-sandbox. Nested browsing contexts inherit genuine APIs your stubs never see — the same pattern as the Haiou prompt-adware abuse of trusted agent surfaces from a different direction.

Our verification was read-only. We read the full Check Point Research article first-hand (“ChatGPT Lockdown Mode Bypass: Phishing, Malware Delivery, and Silent Data Exfiltration,” 5 November 2026, research by Alexey Bukhteyev: Lockdown Mode channel restrictions; February 2026 HTML preview feature; nested-iframe sandbox with allow-popups and allow-popups-to-escape-sandbox; stubbed window.open versus genuine contentWindow.open; exfiltration, spoofed-window malware, shared-chat, forced-sign-out credential-theft and Classic zero-click scenarios; responsible disclosure with the 18 September 2026 fix and confirmed retest). The earlier DNS-tunneling runtime flaw is background as reported in that same article. The Lockdown Mode feature descriptions link to our prior launch coverage. We rendered no preview, opened no popup, ran no GPT, and contacted no vendor. Brave Search was used for discovery only.

Sources: