{
  "id": 18523393,
  "title": "'AI security controls are only as strong as the wider application environment around them': OpenAI forced to patch after experts bypass ChatGPT 'lockdown mode' to gain access to entire chat history",
  "url": "https://urgent.news/2026/11/06/ai-security-controls-are-only-as-strong-as-the-wider-application",
  "topic": "ai",
  "section": "AI",
  "published": "2026-11-06T16:05:00.000Z",
  "source": {
    "name": "TechRadar",
    "slug": "techradar",
    "url": "https://www.techradar.com/pro/security/ai-security-controls-are-only-as-strong-as-the-wider-application-environment-around-them-openai-forced-to-patch-after-experts-bypass-chatgpt-lockdown-mode-to-gain-access-to-entire-chat-history"
  },
  "original_language": "en",
  "account": "Researchers recently bypassed the ChatGPT Lockdown Mode, revealing that prompt-injection attacks could potentially evade built-in protections. This flaw allowed sandbox escapes, which could facilitate data theft, phishing, malware delivery, or malicious popups. OpenAI had to patch the issue on their server-side, underscoring the risks that exist beyond the AI model itself.\n\nCheck Point Research (CPR) discovered a way to circumvent Lockdown Mode and pull off various cyberattacks using the tool. They explained that the issue stemmed from the way code blocks displayed HTML page previews within ChatGPT. These code blocks, which are specially formatted sections to preserve code structure, were rendered in a sandbox to prevent direct access to sensitive data. However, the HTML preview used nested sandboxed frames, allowing popups to escape the sandbox rules and bypass Lockdown Mode.\n\nThe researchers found that by creating a nested frame within the rendered page, they could access unmodified popup functions and bypass all restrictions placed on the original HTML preview. This bypass made the content no longer under sandbox rules, effectively defeating Lockdown Mode. The potential consequences of this vulnerability include credential theft and malware delivery, but the most dangerous scenario is a \"zero-click\" attack, where the popup appears without user interaction.\n\nCPR reported their findings to OpenAI, which subsequently implemented additional safeguards to disable the Lockdown Mode workaround. However, the researchers emphasized the need for organizations to broaden their focus beyond model security. They recommended improving visibility into AI usage, controlling sensitive data exposure, and considering the applications, runtimes, connectors, and other components surrounding the model as part of the overall AI attack surface.",
  "summary": "Lockdown Mode was bypassed with HTML popups but OpenAI now fixed it.",
  "key_points": [
    "Researchers bypassed ChatGPT Lockdown Mode, revealing sandbox escape vulnerabilities",
    "HTML page previews in sandboxed frames allowed popup functions to escape restrictions",
    "OpenAI patched the issue, highlighting need to secure AI application environment"
  ],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 2,
    "also_reported_by": [
      {
        "outlet": "Tech.eu",
        "title": "OpenAI “catalyst” for startups, says European executive, amid startup application layer concerns",
        "url": "https://urgent.news/2026/11/06/openai-catalyst-for-startups-says-european-executive-amid-startup",
        "published": "2026-11-06T11:05:00.000Z"
      }
    ]
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}