TORONTO, Nov. 12, 2026 — Check Point Research has disclosed a vulnerability that bypassed Lockdown Mode, the ChatGPT security setting designed to stop prompt-injection attacks from stealing user data. The flaw is already fixed, and Check Point has confirmed the technique no longer works. But the finding carries a lesson that outlives the patch: an AI security control is only as strong as the wider application environment around it.

Lockdown Mode was introduced by OpenAI in June 2026 as an optional advanced security setting for logged-in ChatGPT users. Its job is to reduce the risk that a prompt-injection attack can exfiltrate sensitive data by making ChatGPT or one of its tools issue outbound web, app, connector, or file-download requests.

Check Point Research, led by Alexey Bukhteyev, found the weakness not in the AI model but in the HTML page preview inside ChatGPT code blocks, a feature OpenAI added in February 2026 that renders user-controlled HTML and JavaScript inside a sandbox. The preview used two nested sandboxed iframes, and while ChatGPT intercepted direct attempts to open new windows, the sandbox permissions still allowed popups and allowed them to escape the sandbox. By creating another nested frame, an attacker could reach an unmodified popup function and open content free of both the sandbox and Lockdown Mode restrictions.

The impact was serious. An attacker could silently exfiltrate an entire chat history to an external server, steal credentials through phishing windows, or deliver malware, all through the trusted ChatGPT interface. The attack could start from a crafted prompt, a malicious GPT, or a shared chat. In the ChatGPT desktop app, known as ChatGPT Classic, it was zero-click: simply having a conversation was enough to trigger silent data exfiltration. In the browser, the victim still had to click a preview.

Check Point responsibly disclosed the vulnerability to OpenAI. On September 18, 2026, OpenAI deployed a fix by removing the allow-popups and allow-popups-to-escape-sandbox permissions from the outer HTML-preview sandbox iframe. Check Point retested the issue and confirmed that the exploitation technique no longer works. No CVE identifier was assigned, and no exploitation in the wild was reported.

"The control did its job. The application around it did not," said Sarah Reid of Securetron. "Lockdown Mode was a real safeguard, and it was defeated by two permissions on an iframe that nobody had reviewed as part of the security boundary. That is the pattern we see across enterprise AI deployments: the model gets the scrutiny, while the surrounding plumbing, previews, connectors, and tool calls go ungoverned."

That is why Securetron built AI-FW, a self-hosted AI firewall and governance gateway that sits between AI agents and the models they call. AI-FW inspects every prompt and response, inbound and outbound, for jailbreaks, prompt injection, PII, toxicity, and data exfiltration, scores requests against natural-language policies with semantic intent analysis, and applies rolling risk scores with automatic blocking. Every transaction lands in a metadata-only audit log, so security teams get full visibility without raw content ever being stored. The gateway is fail-closed by design: a scanner error or missing configuration blocks the request rather than forwarding it unfiltered.

"Governance has to live where the traffic actually flows," Reid added. "If the control point is a setting inside one application, the next bypass will come from a different feature in the same application. Put the inspection at the gateway, and every agent, every model, and every tool call passes through the same checks."

AI-FW runs in the customer's own environment, on-premises or in their cloud, so traffic never needs to leave their network. The free Community Edition is proprietary free-to-use software, not open source, and includes 10 billion tokens per rolling 30 days with no credit card required. More information is available at https://aifw.io.

About Securetron: Securetron builds self-hosted security software for the AI and PKI era. Its products are AI-FW, the AI firewall and governance gateway for AI agents and LLM backends (https://aifw.io), and PKI Trust Manager, the enterprise certificate lifecycle management platform (https://securetron.net).

Press Contact: Sarah Reid, Securetron, 1 Yonge St, Toronto, ON M5E 1E6, Canada, +1 (438) 927-8036, [email protected], https://aifw.io