Skip to navigation

Threat reportVulnerabilityTL-2026-5326

ChatGPT Lockdown Mode Bypass via HTML Preview Nested Iframes Enables Phishing, Malware Delivery, and Silent Data Exfiltration

highPATCHED

Check Point Research disclosed a flaw in ChatGPT's HTML page preview feature in which nested iframes reached an unrestricted window.open and escaped the preview sandbox, bypassing Lockdown Mode protections and opening popups with attacker-controlled content. Described scenarios include zero-click chat-history exfiltration via a malicious GPT in ChatGPT Classic, credential theft via forced re-authentication, malware disguised as application updates, and phishing via spoofed application windows.

Key facts for TL-2026-5326

IdentifiersTL-2026-5326
Also known asChatGPT HTML Preview Sandbox Escape, ChatGPT Lockdown Mode Bypass
SeverityHIGH
Exploitation statusPublic proof-of-concept exploit
Affected productsOpenAI ChatGPT (web); OpenAI ChatGPT Classic (Electron desktop app)
Weaknesses (CWE)CWE-693, CWE-1021
ToolsFakeUpdates
MITRE ATT&CK techniquesT1005 Data from Local System, T1036 Masquerading, T1056.003 Web Portal Capture, T1204.001 Malicious Link, T1204.002 Malicious File, T1213 Data from Information Repositories, T1566.002 Spearphishing Link
MotivationUNKNOWN
Target sectorstechnology, enterprise, general
Target regionsGlobal
Detection rules9 (1 shown free)
Sources9 cited sources

Detection coverage for TL-2026-5326

As of 2026-11-05, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5326 across Splunk SPL, Microsoft KQL and Sigma, covering 8 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: ChatGPT-Referred Executable/Script/Archive Download (HTML Preview Popup Delivery)

Behaviour-first detection of the malware-delivery scenario in the ChatGPT HTML preview nested-iframe sandbox escape (TL-2026-5326). Sysmon EventCode 15 Zone.Identifier streams are inspected for a ReferrerUrl or HostUrl of chatgpt.com / chat.openai.com on files with executable, script, installer or archive extensions. Per Check Point Research, browser clients auto-download files from the escaped popup, so a ChatGPT-origin executable download is a strong signal of the fake-application-update lure. No in-the-wild exploitation is reported, so treat this as early warning and hunting content.

  • Languages: Splunk SPL, Microsoft KQL, Sigma
  • ATT&CK: T1204.002, T1189, T1036
  • Data sources: sysmon (EventCode 15 FileCreateStreamHash), windows_endpoint
  • Severity: high
  • Confidence: medium

Splunk SPL

index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=15 TargetFilename="*:Zone.Identifier" earliest=-24h
| where match(Contents, "(?i)(ReferrerUrl|HostUrl)=https?://(www[.])?(chatgpt[.]com|chat[.]openai[.]com)")
| eval downloaded_file=replace(TargetFilename, ":Zone[.]Identifier$", "")
| where match(downloaded_file, "(?i)[.](exe|msi|msix|appx|scr|dll|js|jse|vbs|vbe|hta|ps1|bat|cmd|lnk|iso|img|zip|7z|rar|jar)$")
| stats count min(_time) as first_seen max(_time) as last_seen values(downloaded_file) as files values(Image) as download_client by host, User
| convert ctime(first_seen) ctime(last_seen)

Microsoft KQL

DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType == "FileCreated"
| where FileOriginReferrerUrl has_any ("chatgpt.com", "chat.openai.com") or FileOriginUrl has_any ("chatgpt.com", "chat.openai.com")
| where FileName matches regex @"(?i)[.](exe|msi|msix|appx|scr|dll|js|jse|vbs|vbe|hta|ps1|bat|cmd|lnk|iso|img|zip|7z|rar|jar)$"
| project Timestamp, DeviceName, AccountName = InitiatingProcessAccountName, FileName, FolderPath, SHA256, FileOriginUrl, FileOriginReferrerUrl, InitiatingProcessFileName, InitiatingProcessCommandLine

Sigma

title: Executable or Archive Downloaded With ChatGPT Referrer
id: 7d1c4a52-3e8b-4f06-9a27-b15e0c8d3a11
status: experimental
description: Detects a file download whose Zone.Identifier referrer or host URL is chatgpt.com or chat.openai.com and whose extension is executable, script or archive. Matches the Check Point Lockdown Mode bypass malware-as-update scenario where a popup escaping the HTML preview sandbox triggers a download.
references:
    - https://research.checkpoint.com/2026/chatgpt-lockdown-mode-bypass-phishing-malware-delivery-and-silent-data-exfiltration/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-05
tags:
    - attack.initial-access
    - attack.t1189
    - attack.execution
    - attack.t1204.002
    - attack.defense-evasion
    - attack.t1036
logsource:
    category: create_stream_hash
    product: windows
detection:
    selection_referrer:
        Contents|contains:
            - 'ReferrerUrl=https://chatgpt.com'
            - 'ReferrerUrl=https://chat.openai.com'
            - 'HostUrl=https://chatgpt.com'
            - 'HostUrl=https://chat.openai.com'
    selection_ext:
        TargetFilename|contains:
            - '.exe:'
            - '.msi:'
            - '.scr:'
            - '.hta:'
            - '.js:'
            - '.vbs:'
            - '.ps1:'
            - '.bat:'
            - '.lnk:'
            - '.iso:'
            - '.zip:'
    condition: selection_referrer and selection_ext
falsepositives:
    - Users legitimately downloading files that ChatGPT generated such as zip archives or ps1 and js samples
    - Developers exporting scripts from ChatGPT code blocks
level: medium

Known false positives:

  • Users legitimately downloading ZIPs, scripts or installers that ChatGPT generated for them (code-interpreter output, ps1/js samples)
  • Developers exporting artifacts from ChatGPT code blocks or canvas

Tuning notes: Requires Sysmon 13+ with FileCreateStreamHash logging that captures Zone.Identifier Contents. Allowlist code-interpreter output extensions (.zip, .ps1) for developer groups or lower their severity; keep .exe/.msi/.scr/.hta/.iso at high. Correlate hits with the user's ChatGPT session and the downloaded file hash. Chrome and Edge write ReferrerUrl; Firefox may only write HostUrl. The source reports no in-the-wild exploitation, so this is an early-warning rule.

8 more detection rules (Splunk SPL, Microsoft KQL, Sigma) · unlock with TL Creds. Sign up free to unlock the detection rules or query them with the Threadlinqs MCP server (Purple)
  • ChatGPT Lookalike / PoC Attacker Domain Access (Phishing and Fake Update) · unlock with TL Creds
  • Execution Of File Downloaded From ChatGPT Context (Fake Update Executed) · unlock with TL Creds
  • ChatGPT Classic Direct-To-Public-IP Connection (Exfiltration Channel) · unlock with TL Creds
  • ChatGPT Classic Writes Executable/Script/Archive To Disk · unlock with TL Creds
  • Browser Spawning Script Host / LOLBin (Post-Download Execution) · unlock with TL Creds
  • Proxy Download With ChatGPT Referrer (Phishing / Fake Update Delivery) · unlock with TL Creds
  • ChatGPT Classic Spawning Interpreter or LOLBin (User Execution of Fake Update) · unlock with TL Creds
  • ChatGPT Classic Zero-Click Exfiltration - DNS To Non-OpenAI Domain · unlock with TL Creds

Indicators of compromise for TL-2026-5326

As of 2026-11-05, Threadlinqs Intelligence tracks 8 indicators of compromise for TL-2026-5326.

Sample indicators (2 of 8)

  • Domain: chatgpt[.]com
  • Domain: evilwebsite[.]com

Defanged, TLP:CLEAR. Full set of 8 indicators: unlock with TL Creds.

8 indicators of compromise · unlock with TL Creds. Compare plans

How ChatGPT Lockdown Mode Bypass via HTML Preview Nested Iframes works

OpenAI deployed a fix on 2026-09-18.

ChatGPT added an HTML page preview feature to code blocks in February 2026. Rendered HTML runs inside nested sandboxed iframe layers intended to isolate user-controlled content from the main chatgpt.com application context (parent document, UI state, cookies and localStorage). The outer HTML-preview sandbox iframe was configured with the permissive tokens allow-popups and allow-popups-to-escape-sandbox.

According to Check Point Research, the first sandbox layer redefined/blocked window.open, so a direct window.open("about:blank") call failed. However, creating a nested iframe inside the sandboxed page and calling that iframe's contentWindow.open("about:blank") succeeded. Because the outer sandbox carried allow-popups-to-escape-sandbox, the resulting popup was not subject to sandbox restrictions, giving attacker-controlled content an unrestricted browsing context. This undermines Lockdown Mode, an optional advanced setting that aims to reduce prompt-injection data exfiltration by restricting live web access to cached content, blocking internet image loading, disabling network requests from Canvas-generated code, and disabling Deep Research, Agent Mode, live connectors and file downloads.

Check Point described several abuse scenarios. (1) Zero-click data exfiltration in ChatGPT Classic (the Electron-based desktop app): a malicious GPT could silently leak the entire chat history to attacker-controlled servers, because Classic allowed window.open to execute without a user gesture. (2) Credential theft: attackers could reload content in the main ChatGPT window and force a sign-out, presenting a convincing authentication prompt on an attacker-controlled page. (3) Malware delivery: popups retained the ChatGPT application icon while showing attacker-chosen titles, enabling fake application-update prompts; browser versions auto-downloaded files while Classic required additional clicks. (4) Phishing/malware via shared chat links, which could reach unauthenticated users without any account requirement.

OpenAI deployed a fix on 2026-09-18 by removing allow-popups and allow-popups-to-escape-sandbox from the outer HTML-preview sandbox iframe. Affected: ChatGPT web and ChatGPT Classic. No CVE or CVSS was assigned, and the source reports no in-the-wild exploitation, IOCs or attribution; severity is analyst-assigned. This follows an earlier Check Point disclosure of a DNS-based hidden outbound channel in the ChatGPT code-execution runtime (fixed 2026-02-20).

MITRE ATT&CK techniques by tactic:

Collection

T1005 Data from Local System; T1213 Data from Information Repositories

Defense Evasion

T1036 Masquerading

Credential Access

T1056.003 Web Portal Capture

Execution

T1204.001 Malicious Link; T1204.002 Malicious File

Initial Access

T1566.002 Spearphishing Link

Remediation for ChatGPT Lockdown Mode Bypass via HTML Preview Nested Iframes

Patches

  • OpenAI server-side fix deployed 2026-09-18 (no customer action documented in source)

Immediate actions

  • Confirm ChatGPT web and ChatGPT Classic clients are current; the server-side fix (removal of allow-popups and allow-popups-to-escape-sandbox from the HTML-preview sandbox iframe) was deployed 2026-09-18
  • Warn users not to trust popups or re-authentication prompts that appear while viewing ChatGPT chats, shared chats or custom GPTs
  • Treat unexpected application-update prompts or automatic file downloads originating from ChatGPT sessions as suspicious and report them

Workarounds

  • Avoid rendering HTML previews of untrusted content in ChatGPT prior to the fix
  • Use browser-based ChatGPT rather than ChatGPT Classic for untrusted GPTs, as Classic permitted zero-click window.open

Longer-term hardening

  • Restrict use of untrusted custom GPTs and shared chat links in enterprise policy
  • Do not rely on Lockdown Mode alone as a control against data exfiltration; layer endpoint and network monitoring
  • Hunt for downloads and executables launched from browser or ChatGPT Classic (Electron) processes

Affected and fixed versions

  • OpenAI — ChatGPT (web)
    Vulnerable versions: HTML page preview feature prior to 2026-09-18 fix
    Fixed in: Server-side fix deployed 2026-09-18
  • OpenAI — ChatGPT Classic (Electron desktop app)
    Vulnerable versions: HTML page preview feature prior to 2026-09-18 fix
    Fixed in: Fix deployed 2026-09-18

Timeline of ChatGPT Lockdown Mode Bypass via HTML Preview Nested Iframes

  • locked-ioc-8 added the HTML page preview feature to ChatGPT code blocks (February 2026; exact day not stated in source).
  • locked-ioc-8 introduced Lockdown Mode and Elevated Risk labels for ChatGPT, ChatGPT Atlas and Codex, initially for Enterprise, Edu, Healthcare and Teachers plans; this is the protection later shown to be bypassable.
  • locked-ioc-8 closed the separate DNS-based hidden outbound channel in the code-execution runtime previously reported by locked-ioc-5.
  • Check Point's DNS data-leakage disclosure for the ChatGPT code-execution runtime was reported publicly (The Register).
  • Lockdown Mode was reported as rolling out to personal ChatGPT accounts and self-serve ChatGPT Business accounts, widening the population relying on it.
  • locked-ioc-8 deployed a fix removing allow-popups and allow-popups-to-escape-sandbox from the outer HTML-preview sandbox iframe.
  • locked-ioc-5 published its analysis of the Lockdown Mode bypass via nested iframes in the HTML preview.

Sources cited for ChatGPT Lockdown Mode Bypass via HTML Preview Nested Iframes

Drafted by the Threadlinqs research pipeline from 9 sources; published ; last updated —.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level

Latest Threats