ChatGPT's Lockdown Mode exists to limit what a prompt injection can do with your data. Check Point Research, in work published by Alexey Bukhteyev, found a way around it that never touched Lockdown Mode at all.

The bug was in the HTML page preview, the feature that renders a code block so you can see the page it describes.

The mechanism

That preview runs inside nested sandboxed iframes. The outer one carried two permission tokens: allow-popups and allow-popups-to-escape-sandbox.

Those two are worth reading in their normative form, because the second one is more generous than its name suggests. MDN defines allow-popups as allowing popups created by things like Window.open, and notes that without the keyword such functionality silently fails. And allow-popups-to-escape-sandbox allows a sandboxed document to open a new browsing context without forcing the sandboxing flags upon it — the new window is not bound by the restrictions that applied to the frame that opened it.

The intended use of that second token is advertising: an ad can sit inside a tight sandbox while the page it links to opens normally.

ChatGPT knew popups were a risk and dealt with it by overriding window.open so that opening one required the user's approval. That is a sensible mitigation and it covered the window object the preview page had.

It did not cover the others. A page inside the preview could create a nested iframe and call that frame's own open method, which nothing had overridden. The call succeeded, the two tokens on the outer frame meant the result was not bound by the sandbox, and content opened that way was outside the restrictions the whole arrangement existed to impose.

What that bought

Check Point demonstrated three things: silent exfiltration of chat contents, a fake ChatGPT update prompt used to get the victim to download malware, and credential phishing.

The worst case was the desktop application. In the Electron build, the popup behaviour worked with no user gesture at all. No click, no confirmation, nothing to notice. A conversation with a malicious GPT was sufficient.

OpenAI fixed it by removing both tokens from the outer preview iframe. Check Point retested and says the technique no longer works.

The part worth keeping

Lockdown Mode did what it said it would do. It was not bypassed, jailbroken, or argued out of its instructions. An attribute on an iframe two levels up made it irrelevant.

This is the shape most AI security failures are going to have, and it is worth saying clearly because the public conversation is pointed somewhere else. The interesting attacks on these products are not going to be clever prompts that talk a model into misbehaving. They are going to be ordinary web security bugs in the enormous amount of conventional software wrapped around the model: sandbox attributes, origin checks, postMessage handlers, Electron defaults, and overrides applied to one object when there were two.

A model-layer control is only as good as the application that renders its output. Here the control was sound, the application was not, and the result was the same as if the control had failed.

One detail that generalises: the override on window.open was a real mitigation written by somebody who had thought about the problem. It failed because the risk surface was not one object but any object reachable from the page. Enumerating that surface is a browser security exercise, not an AI safety exercise, and the teams shipping these features need somebody who does the first kind of work.

What is not established

  • When the fix actually shipped. One account has OpenAI confirming a fix on 18 September, which sits oddly with a November publication, and we did not settle the sequence.
  • Whether this was exploited before it was fixed. No evidence either way has been published.
  • Whether the same nested-frame technique reaches other features built on the same preview component.
  • Whether the Electron no-gesture behaviour was specific to one build or general to the desktop application across versions.
  • What Lockdown Mode blocks that this bypass did not reach. The research describes what got out, not the full boundary.