The report doesn't ask users to do anything to protect themselves from this specific flaw. What matters is the lesson for any company relying on a security switch.

◢What is ChatGPT's Lockdown Mode?

That comes at a price. Browsing is limited to cached content, images from the internet don't load, and Deep Research, Agent Mode and live connectors are switched off. OpenAI pitches it at people and organisations handling sensitive data, not at everyone. So the people who turn it on tend to be the ones with the most to lose.

◢How did they get around it?

The problem wasn't in the model but in a convenience feature. Since February 2026, ChatGPT can show a preview of HTML pages that appear in a code block. Since that means running someone else's code inside the app, the preview is kept in an isolated sandbox.

That sandbox had a gap. ChatGPT intercepted attempts to open new windows and asked for permission, but the sandbox's own settings still allowed them, and allowed them to open outside the sandbox. Check Point created another frame inside the page, reached the original function that way and opened a window no longer subject to those restrictions, or to Lockdown Mode's.

Getting there only took a malicious prompt, a malicious GPT or a shared chat.

◢What could an attacker do?

Check Point describes three scenarios and demonstrates them on video:

• ▹Quietly steal the full chat history and uploaded files. In ChatGPT Classic no click was needed: having a conversation was enough. Its demo uses a malicious GPT that sends messages to an external server.
• ▹Install malware disguised as an update. The fake window kept the app's icon and the attacker chose the title. In a browser it was easier still, because automatic downloads aren't blocked, and the victim of a shared chat didn't even need an account.
• ▹Steal the password. The attacker could force the user to sign out and ask them to log back in on a page the attacker controlled.

◢What we know and what we don't

What's confirmed comes from Check Point's report: they told OpenAI, the company informed them on September 18 that it had removed those permissions, and when they retested, the attack no longer worked.

It's not an isolated case. The Hacker News reports that a week earlier Parameter Labs explained another way to take over an account through a shared chat and its HTML preview. Check Point says it's a different flaw in the same component.

◢What to do if you use ChatGPT at work

This flaw is fixed, but these precautions will serve you for the next one:

• ▹Treat shared chats you receive like any link from a stranger. If you weren't expecting it, don't click anything inside.
• ▹Only use GPTs from authors you trust, especially if you'll handle company data with them.
• ▹Be suspicious of any window inside ChatGPT asking you to update or to sign in again. Close it and type the address yourself.
• ▹Keep the desktop app up to date and turn on two-step verification on your account.
• ▹If you run security at a company, keep considering Lockdown Mode for people handling sensitive information. Just don't count it as a guarantee.

◢What this flaw leaves behind

A security setting protects the routes its designers know about. Here the usual exits were closed and the data found another one through a feature added for convenience. Check Point itself concludes that these protections help, but guarantee nothing on their own.

That's why I still think the first line of defence is deciding what goes into the tool: I have a guide on what data not to paste into ChatGPT and another on what prompt injection is. If you want your staff to have these criteria clear, it's part of what I cover in my cybersecurity and AI training.