Researchers find a way around ChatGPT's strictest privacy setting

Security researchers have shown that ChatGPT's strictest privacy setting could be bypassed. Lockdown Mode, which OpenAI added in June 2026, is meant to stop chat data from leaking out. A flaw let attackers slip around it. OpenAI fixed the problem on September 18, 2026, after the researchers reported it.

What happened

Lockdown Mode is an optional setting. It limits the outgoing connections ChatGPT can make, so private information is harder to send to an attacker's server. It is aimed at prompt injection, where hidden instructions in text trick an AI into doing things its user never asked for.

Researchers at Check Point found a gap in a different feature, the HTML preview. That feature shows web-style content inside a chat, in a walled-off area called a sandbox. Popup windows could escape that area, and once they did, Lockdown Mode no longer applied to them.

Why it matters

Check Point's Eli Smadja said the flaw could allow silent chat data theft, phishing and malware delivery. That included zero-click theft in the ChatGPT desktop app, meaning the user does not have to click anything. The attacker would need to get content in front of the victim through a crafted prompt, a malicious custom GPT or a shared chat.

The popup also gave the attacker full control over what appeared on screen. That could be used to show a fake ChatGPT update and push the user to click a link and download malware.

The bigger lesson is that a security setting is only as strong as the app around it. Smadja noted the weakness was not in the AI model itself. He also said the underlying issue was not limited to the Electron-based desktop environment.

Who it affects

The people most exposed were ChatGPT users, especially on the desktop app, who open shared chats or custom GPTs made by others. Businesses that rely on Lockdown Mode to protect sensitive conversations should take note, since the setting did not hold up in this case. The material does not say whether attackers ever used the flaw against real people.

What to do

The alert box above lists the steps. In short, keep the desktop app current, be wary of links and GPTs from strangers, and treat any update pop-up with suspicion.

What happens next

This was not the only recent finding. A week earlier, Parameter Labs described a way to take over an account through a malicious public share link. Opening the link and clicking the HTML preview once was enough. In September, Check Point also showed a hidden channel that let an attacker run tasks through a victim's session.

Expect more reports like these as AI tools gain access to more data and apps. Each new feature around the chat window is another place for a gap to appear.