ChatGPT Lockdown Mode: zero-click chat theft

Check Point disclosed on November 5, 2026, a ChatGPT flaw that OpenAI had already patched on September 18. Lockdown Mode, an optional setting OpenAI introduced in June 2026, is supposed to limit data leaving a conversation when a prompt tries to call out. Eli Smadja, Check Point’s head of research, says the bug could quietly take chat contents, present phishing pages, or steer someone toward malware. On the desktop app, one path needed no click from the user.

ChatGPT renders HTML previews inside code blocks. That preview is meant to sit in a sandbox, away from cookies and local storage, and away from the network unless the person agrees. Lockdown Mode tightens the same idea by cutting outbound requests that would carry a conversation to somewhere else. Check Point found that the way those previews open new windows could place content outside the sandbox. Once that happened, Lockdown Mode’s limit on outbound traffic did not cover what the window could do. Check Point says the weakness is in the application around the model, and that it is present beyond the desktop client.

The delivery paths named in the disclosure are a crafted prompt, a malicious custom GPT, or a shared chat. Whoever controls that window controls what it shows, including a page dressed up as a ChatGPT update that asks for a download.

A different bug on the same preview

In late October, Parameter showed a shared ChatGPT link that could act as the signed-in reader and reach private chats. OpenAI closed that one within eight days of the October 18 report. Check Point told The Hacker News the two findings are different flaws on the same preview component. The share-link bug ran in the victim’s authenticated session on the ChatGPT site. The Lockdown Mode bug is the one that let preview content step past the control meant to keep data inside the chat. Both are fixed on current OpenAI builds. They do not share a patch date, and a team that tracked only the October bounty item has not automatically accounted for September 18.

Check Point also described, earlier in September, a separate cross-account channel in which a hidden task could run with the tools and connected apps of a victim’s session while the visible reply looked ordinary. That report is context for how shared chats and custom GPTs keep showing up as the way an instruction arrives. It is not this CVE-less preview bug, and it does not change the September 18 fix.

What to check on the desktop and in the tenant

OpenAI’s fix date is September 18, 2026. The web app picks up a service-side change when OpenAI ships it. The desktop app does not, if a machine is still on an older install. Inventory ChatGPT desktop clients the way you inventory any other browser: version or build date, on corporate laptops and on the machines staff use for work chat. Anything that predates September 18 is still the build Check Point walked through.

Turn Lockdown Mode on for staff who paste source, customer notes, or incident detail into ChatGPT. Treat the toggle as incomplete on a client that missed the September 18 fix. After the update, the setting is still worth having. It was built for prompt-injection leaks, and the hole was a window beside it, which the patch is what closes.

Shared chats and third-party GPTs are the paths Check Point named. Where the tenant can restrict them, restrict them for accounts that hold sensitive work. A link that previews HTML is a document from outside the company, even when the domain is OpenAI’s. Tell people that a ChatGPT “update” offered inside a conversation is a lure. Real client updates come from the install you already manage.

For anyone who opened an untrusted share or a custom GPT before September 18, assume that conversation could have left the app, including when Lockdown Mode was on. Watch for follow-up mail or messages that quote the contents of that chat. The patch stops the path going forward. It does not pull back a conversation that already took the window.

This briefing relies on public reporting by The Hacker News and on Check Point’s disclosure. It does not include exploit procedures or proof-of-concept detail.