Researchers found and responsibly disclosed a now-patched ChatGPT weakness that could let malicious content escape Lockdown Mode protections. An attacker could use a crafted prompt, malicious custom GPT, or shared chat to steal chat data without interaction or show a convincing fake ChatGPT update that persuades a user to download malware.
Researchers found a now-patched weakness in how ChatGPT handled popup windows, which could be used to bypass Lockdown Mode protections. An attacker could use a crafted prompt, a malicious custom GPT, or a shared chat to exfiltrate chat data or deliver malicious content. Because the attacker controlled the content displayed in the popup, they could render a convincing fake ChatGPT update notice designed to persuade a victim to click a download link and install malware. A separate reported issue involved shared conversations: if an attacker published a malicious conversation using ChatGPT's normal sharing feature and the victim opened an HTML preview, the payload could execute with access to the victim's authenticated web session.
The lure worked because it appeared inside a trusted, familiar interface, the ChatGPT application itself, rather than through an external email or unfamiliar website. Victims had no reason to doubt an update notice rendered inside their own chat window. In the shared-chat scenario, the social engineering relied on misplaced trust in links shared by a known or seemingly reputable source, combined with HTML previews that could open automatically once marked previewable.
Organizations and individuals using ChatGPT or similar AI tools should treat in-app update notices with the same skepticism as unsolicited email attachments. Updates should only be installed through the approved application update process, not through links shown inside a conversation or popup. Users should avoid opening HTML previews or following action requests in unsolicited shared conversations, particularly from unknown senders. Sensitive business information should not be entered into untrusted prompts, custom GPTs, or shared chats, since malicious content may attempt to access or export conversation data. Finally, keeping AI applications current and following organizational guidance on approved AI tools matters because, as the findings highlight, AI security controls are only as strong as the wider application environment around them.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Check Point disclosed a now-patched flaw in ChatGPT HTML previews that could bypass Lockdown Mode protections through popup-window handling, allowing a crafted prompt, malicious GPT, or shared chat to exfiltrate data or deliver malicious content.
Yes, the attack could be zero-click for data theft in the ChatGPT desktop application, though the fake update lure still required the victim to click a download link.
Yes, OpenAI addressed the reported Lockdown Mode issue on September 18, 2026, following responsible disclosure.
Treat unexpected update notices shown within a conversation or popup as suspicious and use the approved application update process rather than clicking a download link.
ChatGPT says you need an update. But did ChatGPT actually say it? A crafted prompt, custom GPT, or shared chat could trigger a popup the sender controls. It looks like an OpenAI notice, then points you to a software download. That’s the tell: an app update shouldn’t come from a chat. Researchers found an HTML-preview flaw that could bypass Lockdown Mode; OpenAI patched it in September 2026. If an update appears in a chat popup, ignore its link and update through your approved app process.
Check Point Research found and reported a ChatGPT vulnerability that could let malicious content escape a protected preview environment, bypassing Lockdown Mode. The flaw could support fake ChatGPT update windows, credential-harvesting reauthentication pages, malware downloads, and, in the Classic…
Check Point researchers demonstrated a real proof-of-concept where a victim’s ChatGPT session could be tricked into running hidden, attacker-controlled tasks in parallel with the user’s normal request. In the demo, the attacker used a covert cross-account channel to make ChatGPT access the victim’s…
Researchers demonstrated that malicious web pages and local previews can abuse embedded browsers in popular AI coding assistants. The attacks can hide instructions from users, spoof trusted login addresses, or access sensitive files, creating realistic risks for developers who open untrusted links…
This news roundup describes multiple real-world social engineering operations, including a device-code phishing service that stole access to over 12,000 inboxes and a North Korean campaign posing as recruiters to trick developers during fake coding interviews. The attackers used legitimate login…
Check Point reports that scammers are now impersonating ChatGPT/OpenAI in phishing campaigns, reflecting how mainstream the service has become. One documented example used a fake “ChatGPT Plus payment failure” notice that sent victims to a fraudulent payment page designed to capture full credit…
Check Point reports that OpenAI’s ChatGPT became a top-10 most impersonated brand in Q2 2026 phishing. One observed example used a fake “ChatGPT Plus payment failed” billing email to drive victims to a credit-card theft page. The report also notes other brand-impersonation scams using cloned stores…
