If you paste work documents, client notes or anything sensitive into ChatGPT, Lockdown Mode is the setting meant to stop that information from being smuggled out by a booby-trapped prompt. Researchers at Check Point Research (CPR) say they found a way around it, through a part of the app the setting did not cover.
OpenAI has since removed the permissions that made the technique work. CPR retested and confirmed the method no longer works, and says it found no evidence the flaw was used in real attacks. There is nothing to update on your side, but the finding is a useful reminder of how far a single safety switch can be trusted.
Contents
What ChatGPT Lockdown Mode is supposed to do
Lockdown Mode is an optional ChatGPT setting aimed at prompt injection, where hidden instructions in a web page, file or shared chat try to make the assistant hand your data to someone else. With it switched on, ChatGPT restricts the usual ways data could leave: live web access, images loaded from the internet and network requests from Canvas. It also turns off Deep Research, Agent Mode, live connectors and file downloads.
How Check Point got around it
The weak point was not the model. It was the sandbox ChatGPT uses to show previews of HTML content, a separate component that renders pages inside the app. According to CPR, that preview sandbox still had permission to open pop-up windows, and those pop-ups could be reached through frames nested inside one another. That gave an attacker an exit that Lockdown Mode never closed.
The attack could start from a malicious prompt, a malicious custom GPT or a shared chat, depending on the scenario. The researchers demonstrated several outcomes:
- Zero-click data leaks in the desktop app: in the ChatGPT desktop application, which is built on Electron, pop-ups opened without the user clicking anything. CPR showed a malicious GPT quietly sending chat messages to a server it controlled while the victim carried on a normal conversation.
- Convincing fake windows: an attacker's pop-up could keep the ChatGPT app icon while showing the attacker's own title and content, which makes a fake app update or phishing message look like it came from ChatGPT itself.
- Login theft: CPR also showed how the main app window could be steered so a signed-out user lands on a fake sign-in page.
One limit is worth knowing. Getting malware onto a computer this way was not zero-click: the victim would still have had to click a link to download a file.
Why one safety switch is not enough
Check Point's point is bigger than one bug. A control built specifically to contain prompt injection was undermined by a weakness somewhere else in the product. AI assistants are no longer just a chat box: they now come with desktop apps, preview windows, sandboxes, code execution, file uploads and connectors to other services, and each piece has its own rules.
"Securing AI cannot stop at the model or rely on a single protective control," said Pedro Drimel Neto, who leads malware analysis at Check Point Research. If people believe a "lockdown" setting seals everything, they may share more than the rest of the app can actually protect.
This is the second Check Point finding in a week about how AI tools get turned against the people using them. Earlier, the company showed scammers planting fake airline helplines that surface in AI-generated answers, and its latest ranking found Microsoft impersonated in one in three brand phishing attempts.
What to do if you use ChatGPT at work
For individual users the fix is already in place. For companies, CPR's advice is to treat no single "restricted" or "secure" mode as a complete wall, and to layer protection instead:
- Know what is in use: find out which AI services staff use and where company information is being shared.
- Set data rules: decide what information employees may give to outside AI services, and enforce it.
- Look at the whole app: check the apps, sandboxes, preview layers, tools and connectors around the model, not only its prompt guardrails.
- Keep retesting: recheck assumptions each time an AI platform adds features or integrations.
- Limit the damage: keep the sensitive information an AI service can reach to a minimum, so one flaw does not expose everything a user can see.
The simplest habit for everyone else is the oldest one: do not paste anything into an AI chat that you would not want to see leave the room, whatever settings are switched on.
