ChatGPT Lockdown Mode flaw could have exposed chat histories, but OpenAI has fixed it
A security weakness in ChatGPT’s Lockdown Mode could have allowed attackers to steal full chat histories, display convincing fake login windows, and potentially deliver malware. The issue was discovered by Check Point Research and publicly detailed in early November. OpenAI fixed the vulnerability on September 18, and follow-up testing confirmed that the attack method no longer works.
Lockdown Mode is an optional ChatGPT security feature designed to reduce the risk of prompt injection attacks. These attacks can trick an AI system into revealing sensitive information or taking unintended actions. While the feature is meant to provide stronger protection for users handling confidential data, researchers found that one part of ChatGPT’s web code preview system created a gap in that protection.
The problem came from the HTML preview feature introduced for ChatGPT code blocks. This feature allows generated web code to be rendered as a live page inside a sandboxed environment. In theory, a sandbox should limit what that preview can do. However, the sandbox still allowed popup windows.
That detail mattered. Researchers found that a nested frame could open a new window outside the area covered by Lockdown Mode. From there, information could be sent to an attacker-controlled server. In a successful attack, a malicious prompt, harmful custom GPT, or shared chat could be used to trigger the exploit.
For users accessing ChatGPT in a browser, the attack still required some interaction. A victim would need to click the preview, although an attacker could disguise it as something innocent or useful. The risk was higher in the older Electron-based desktop version known as ChatGPT Classic, where new windows could open without the user clicking anything. According to the research, simply having a conversation could have been enough for chat history to leak in that environment.
Another concerning part of the attack involved phishing. Fake sign-in prompts could appear in windows that looked like they belonged to ChatGPT, making them more believable. This could have tricked users into entering credentials or other sensitive information.
The good news is that users do not need to take action to patch this specific issue. OpenAI resolved it on the server side, and the bypass technique has been confirmed as blocked.
Even so, the incident is a reminder that AI tools can introduce unusual security risks, especially when they can display web content, run previews, handle files, browse information, or interact with external services. Features designed for convenience can sometimes create unexpected attack paths.
Lockdown Mode remains a useful option for people who work with sensitive information, but it is not meant for every user. When enabled, it limits several ChatGPT capabilities to reduce exposure to risky content and external resources. Web browsing is restricted to cached content, ChatGPT will not load web images, and features such as Deep Research, Agent Mode, live connectors, and file downloads are turned off. Image generation can still be used.
It is also important to understand what Lockdown Mode does not do. It does not control whether your conversations may be used for AI training. That setting is managed separately through ChatGPT’s data controls.
Users who may benefit most from Lockdown Mode include business professionals, journalists, researchers, legal workers, healthcare staff, developers handling proprietary code, and anyone regularly entering private, regulated, or confidential information into ChatGPT.
The setting can be found in ChatGPT under Settings, then Security, then Advanced security, depending on account type, plan, and availability. Some users may also be able to disable Lockdown Mode for a single conversation from the chat menu.
For safer use of shared ChatGPT conversations, especially from unknown sources, it is best to open them in a private browser window without being signed in. Users should also be cautious with any chat that asks them to click previews, enter login details, download files, or interact with unfamiliar popups.
A PIN lock for individual chats can help prevent someone with physical access to your device from reading your conversations, but it does not protect against remote attacks like prompt injection, malicious previews, or phishing windows.
This fixed vulnerability shows why stronger security settings matter, but also why they are not a complete substitute for careful behavior. ChatGPT users should keep apps updated, be cautious with shared chats, avoid entering sensitive credentials into unexpected windows, and consider enabling Lockdown Mode when working with important private data.
