Researchers bypassed ChatGPT Lockdown Mode through HTML popups

Check Point Research (CPR) found a way to bypass ChatGPT’s optional Lockdown Mode through HTML page previews in code blocks. The researchers said the flaw could expose sensitive data and potentially enable other attacks.

Lockdown Mode adds safeguards for people handling highly sensitive information. When enabled, it restricts connections to external services and limits or disables features such as live web browsing, Deep Research, Agent Mode and file downloads, reducing the risk of data exposure through prompt injection.

The researchers traced the bypass to how ChatGPT handled popups in HTML previews. Although the previews ran in sandboxed frames, CPR said the sandbox permissions still allowed popups to escape those protections. By creating a nested frame, the researchers could access popup functions and bypass restrictions on the preview.

CPR said the issue could enable data theft and potentially credential theft or malware delivery. It also described a possible “zero-click” scenario in which a popup appears without a user gesture. The researchers said an attack could originate from a malicious prompt, GPT or shared chat, depending on the scenario.

CPR disclosed the findings to OpenAI, which added safeguards to disable the workaround. The researchers urged organizations to monitor AI use and sensitive data exposure, and to consider the applications, runtimes and connectors around a model as part of the AI attack surface.