Recent findings have revealed a vulnerability in ChatGPT’s Lockdown Mode, which allowed hackers to bypass its security measures. Researchers from Check Point discovered that a hidden pop-up could be used to extract a user’s chat history, display fraudulent windows, and even distribute malware. This security lapse was found in the ChatGPT Classic desktop application but has since been addressed by OpenAI.
OpenAI’s Lockdown Mode and Its Purpose
Introduced initially to business users on February 13, 2026, and later to personal accounts on June 4, OpenAI’s Lockdown Mode was designed to enhance data security. It restricts browsing to cached content, disables live web access, image support, and several other features to protect high-risk users like executives and security teams. However, it is not deemed necessary for the average user.
The Lockdown Mode aims to prevent ‘prompt injection’—a technique where hidden commands manipulate the AI into executing unauthorized actions. This often involves tricking the AI into divulging private information through seemingly benign links.
Uncovering the Lockdown Mode Bypass
This recent discovery marks another instance of vulnerabilities being identified by Check Point. In March, they highlighted a DNS tunneling issue within ChatGPT’s code. The latest flaw indicates that while one loophole may be closed, others could potentially remain open.
The vulnerability was found when OpenAI added an HTML preview feature to ChatGPT’s code blocks. This allowed web pages to be viewed within the chat through nested iframes. Although these iframes are designed to block external scripts and images, they inadvertently permitted pop-ups through specific settings, enabling attackers to bypass security protocols.
Implications and Response
These pop-ups posed significant risks. They could masquerade as legitimate update notifications, prompting users to download malware. Moreover, attackers could silently exfiltrate conversations and uploaded files to external servers. Additionally, the vulnerability could facilitate phishing attempts by tricking users into entering credentials on fake login pages.
Following Check Point’s report, OpenAI swiftly removed the permissions that allowed these pop-ups, effectively neutralizing the threat. The corrective measures were verified by Check Point, who confirmed that the exploit is no longer viable.
Enhancing User Safety
While no immediate action is required from users for this specific fix, exercising caution remains crucial. Users are advised against interacting with unknown prompts, shared chat links, and custom GPTs from untrusted sources. It is also recommended to verify URLs and avoid entering sensitive information unless necessary.
OpenAI acknowledges that while their security features reduce risks, they cannot offer absolute protection. As AI continues to evolve, maintaining vigilant digital habits is essential to safeguarding personal data.
