AI · 16h ago
Check Point Research found that ChatGPT’s HTML previews, added to code blocks in February 2026, could bypass Lockdown Mode and expose users to silent chat-data theft and phishing.
An attacker could deliver crafted HTML through a malicious prompt, GPT, or shared chat. When ChatGPT rendered the preview, the content could get around the mode’s network limits and send conversation data to an external server. The vulnerability could also manipulate ChatGPT Classic’s interface to show arbitrary pop-ups, creating a phishing surface.
Lockdown Mode is therefore less like an isolation boundary than a set of restrictions on network paths: if users process untrusted content in sensitive sessions, the interface displaying it can itself become a route to data exposure.
2 sources covering this story
Researchers Bypass ChatGPT Lockdown Mode to Exfiltrate Chats Without User Interaction
A patched ChatGPT HTML preview flaw let crafted content bypass Lockdown Mode restrictions, enabling chat data exfiltration.
Research by: Alexey Bukhteyev Key Takeaways Introduction Earlier this year, Check Point Research disclosed a security flaw in ChatGPT’s code-execution runtime that allowed sensitive conversation data to be silently exfiltrated to an attacker-controlled server through DNS tunneling, a hidden outbound channel that bypassed the runtime’s network isolation.
Part of the PlainSec briefing for 2026-11-06