Check Point Research found and reported a ChatGPT vulnerability that could let malicious content escape a protected preview environment, bypassing Lockdown Mode. The flaw could support fake ChatGPT update windows, credential-harvesting reauthentication pages, malware downloads, and, in the Classic desktop app, silent theft of chat data. OpenAI said it fixed the issue by removing the popup permissions that enabled the bypass.
Check Point Research identified a way to escape ChatGPT's Lockdown Mode preview sandbox using HTML preview popups. Once escaped, a malicious page could open a spoofed application window that retained the familiar ChatGPT icon while letting the attacker fully control the window title and displayed content. This created a convincing illusion that the user was still interacting with the legitimate ChatGPT application, even though the window was entirely attacker-controlled.
The technique supported several distinct attack paths. One used a fake application update prompt to persuade users to download malware disguised as a legitimate ChatGPT update. Because the ChatGPT Classic app does not allow automatic downloads, the user still had to click a link, but the convincing window dressing made that click more likely. A separate path involved forcibly signing a user out and then presenting an attacker-controlled reauthentication page, silently harvesting credentials when the user tried to log back in. In ChatGPT Classic specifically, researchers found a popup could open without any user gesture at all, enabling silent exfiltration of chat data through a malicious GPT.
A notable aspect of this flaw is that victims did not need a ChatGPT account to be exposed. An attacker only needed to share a chat containing the malicious page, and anyone who clicked content inside that shared chat could be affected. This made the attack surface wider than typical account-based phishing, since the lure could reach casual viewers of shared links as well as regular users. The scenario was described as even easier to pull off in a browser, where automatic downloads are not blocked.
Treat any software update prompt that does not come through your organization's standard update channel as suspicious, regardless of how official it looks. Be wary of unexpected sign-outs followed by reauthentication requests, and navigate to a service directly rather than entering credentials into a page that just appeared. Apply the same caution to shared AI chats that you would to email links, since visual familiarity, like a trusted icon, does not guarantee a safe destination. Finally, avoid placing highly sensitive data into AI tools unless your organization has reviewed and approved that specific use case, since built-in guardrails reduce but do not eliminate risk.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Check Point Research found a way to bypass ChatGPT Lockdown Mode using HTML preview popups that could escape the preview sandbox, allowing an attacker to control window title and content while keeping the ChatGPT icon.
The flaw could support fake ChatGPT update windows that push malware downloads and reauthentication pages that trick users into re-entering credentials after being forcibly signed out.
No. Attackers could share a malicious chat containing the exploit, and anyone who clicked content in that shared chat could be affected even without an account.
Yes, OpenAI reported deploying a fix on September 18, 2026 by removing the popup permissions that enabled the bypass.
A shared ChatGPT chat says, ‘Download ChatGPT update.’ Don’t trust the icon. Researchers found an HTML preview popup could bypass Lockdown Mode. It kept the ChatGPT icon, but the window title and content could be faked. That’s the trick: the icon looks official; the popup isn’t. A shared chat could deliver the lure even to someone without an account. OpenAI says it fixed this. Still, for updates, use your organization’s approved software-update process.
Researchers found and responsibly disclosed a now-patched ChatGPT weakness that could let malicious content escape Lockdown Mode protections. An attacker could use a crafted prompt, malicious custom GPT, or shared chat to steal chat data without interaction or show a convincing fake ChatGPT update…
Check Point researchers demonstrated a real proof-of-concept where a victim’s ChatGPT session could be tricked into running hidden, attacker-controlled tasks in parallel with the user’s normal request. In the demo, the attacker used a covert cross-account channel to make ChatGPT access the victim’s…
This weekly threat bulletin describes real incidents where attackers used human manipulation to break in, including social engineering at Levi Strauss and a Microsoft 365 credential-theft phish at defense supplier IEH. It also highlights a Lazarus-linked campaign using fake job offers and…
Microsoft reports that North Korean threat actors are using AI to make job scams, fake recruiter outreach, fraudulent worker identities, and targeted phishing campaigns faster and more convincing. One group posed as recruiters for a spoofed AI blockchain company and scheduled software-engineer…
This news roundup describes multiple real-world social engineering operations, including a device-code phishing service that stole access to over 12,000 inboxes and a North Korean campaign posing as recruiters to trick developers during fake coding interviews. The attackers used legitimate login…
A phishing email posing as a ChatGPT billing notice pressures users to “update payment information” to avoid service interruption. The button routes through a Google redirect and lands on a fake OpenAI login page that captures usernames and passwords before sending victims to an error page.
