Researchers Found a Way Around ChatGPT's Strictest Privacy Setting

Security researchers at Check Point Research found a way around Lockdown Mode, ChatGPT's strictest optional privacy setting. In the ChatGPT desktop app, a malicious custom GPT could quietly send a user's chat messages to an attacker without the user clicking anything. OpenAI fixed the flaw after the researchers reported it privately.

What Lockdown Mode does

Lockdown Mode is an optional setting meant to stop private information from leaking out of ChatGPT. It targets prompt injection, where hidden instructions in content trick an AI into doing something unintended. The setting limits live web access and internet-hosted images. It also turns off Deep Research, Agent Mode, live connectors and file downloads.

How the bypass worked

The weak spot was a different feature: HTML previews, which show web page code inside a ChatGPT code block. That preview runs in a sandbox, a walled-off area meant to keep it apart from the main app. Researchers found that popup windows could escape this sandbox. By nesting another frame inside the preview, they reached a popup function that ChatGPT had not restricted.

What an attacker could do

The researchers said the flaw could support data theft, credential theft and malware delivery. An attack could start from a malicious prompt, a malicious custom GPT or a shared chat, depending on the scenario. In the desktop app, the popup kept the ChatGPT icon while the attacker controlled its title and content. That made a fake ChatGPT update look believable. The main window could also be forced to sign the user out, which could send them to a fake login page.

• Downloading a file in the desktop app still required the victim to click a link.
• The most serious case needed no click at all.
• A malicious GPT could leak chat messages to an attacker's server during a normal conversation.

Who should pay attention

The risk is greatest for people and teams who paste private files or business details into AI chats. Those chats can hold confidential information, uploaded documents and other sensitive context. The material does not say whether anyone was attacked in real life before the fix.

What to do

• Be cautious with custom GPTs from creators you do not know.
• Treat shared chats from strangers with the same care as unknown links.
• Keep the ChatGPT app updated, and be wary of any update prompt that appears inside a chat.
• Avoid pasting sensitive material into AI chats unless it is needed.

The bigger lesson

Check Point says AI security is only as strong as the environment around the model. Modern AI tools combine models with apps, browser and desktop software, sandboxes, code-running tools and connectors. A weakness in any of those parts can undermine a safeguard like Lockdown Mode, even when the safeguard itself works as designed.