{
  "id": 18378085,
  "title": "Researchers Bypass ChatGPT Lockdown Mode to Exfiltrate Chats Without User Interaction",
  "url": "https://urgent.news/2026/11/05/researchers-bypass-chatgpt-lockdown-mode-to-exfiltrate-chats-without",
  "topic": "ai",
  "section": "AI",
  "published": "2026-11-05T16:42:32.000Z",
  "source": {
    "name": "The Hacker News",
    "slug": "the-hacker-news",
    "url": "https://thehackernews.com/2026/11/researchers-bypass-chatgpt-lockdown.html"
  },
  "original_language": "en",
  "account": "Researchers from Check Point have uncovered a vulnerability that could allow attackers to bypass ChatGPT's Lockdown Mode protections. The flaw exists due to HTML page previews within code blocks, which enable HTML content to be rendered directly in the application. This rendered content is initially confined to a sandbox to prevent access to sensitive app data. However, Lockdown Mode does not fully protect against popups, which can bypass the sandbox restrictions by exploiting the nested sandboxed frames used in HTML previews. By creating an additional nested frame within the rendered page, an attacker can access an unmodified popup function, allowing for data exfiltration, phishing, and malware delivery, even in zero-click scenarios. The vulnerability was addressed by OpenAI on September 18, 2026, following responsible disclosure. This issue underscores the broader security concerns in AI environments, as AI controls are only as robust as the surrounding application framework.",
  "summary": "Cybersecurity researchers have disclosed details of a now-patched vulnerability that could be exploited to bypass Lockdown Mode protections in OpenAI ChatGPT. Lockdown Mode was introduced by the artificial intelligence (AI) company in June 2026 as an optional setting to minimize data exfiltration risks arising from prompt injections. \"The flaw could enable silent chat data theft, phishing,",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}