# ChatGPT Lockdown Mode Bypass via HTML Preview Nested Iframes Enables Phishing, Malware Delivery, and Silent Data Exfiltration

> Check Point Research disclosed a flaw in ChatGPT's HTML page preview feature in which nested iframes reached an unrestricted window.open and escaped the preview sandbox, bypassing Lockdown Mode protections and opening popups with attacker-controlled content. Described scenarios include zero-click chat-history exfiltration via a malicious GPT in ChatGPT Classic, credential theft via forced re-authentication, malware disguised as application updates, and phishing via spoofed application windows. OpenAI deployed a fix on 2026-09-18.

- **Published:** 2026-11-05T14:39:07Z
- **Last reviewed:** 2026-11-05T14:39:07Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5326
- **Card image:** https://intel.threadlinqs.com/og/threat/TL-2026-5326.png
- **ID:** TL-2026-5326
- **Severity:** HIGH
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 (1 shown free below) · **IOCs:** 8 (2 shown free below)

## Description

ChatGPT added an HTML page preview feature to code blocks in February 2026. Rendered HTML runs inside nested sandboxed iframe layers intended to isolate user-controlled content from the main chatgpt.com application context (parent document, UI state, cookies and localStorage). The outer HTML-preview sandbox iframe was configured with the permissive tokens allow-popups and allow-popups-to-escape-sandbox.

According to Check Point Research, the first sandbox layer redefined/blocked window.open, so a direct window.open("about:blank") call failed. However, creating a nested iframe inside the sandboxed page and calling that iframe's contentWindow.open("about:blank") succeeded. Because the outer sandbox carried allow-popups-to-escape-sandbox, the resulting popup was not subject to sandbox restrictions, giving attacker-controlled content an unrestricted browsing context. This undermines Lockdown Mode, an optional advanced setting that aims to reduce prompt-injection data exfiltration by restricting live web access to cached content, blocking internet image loading, disabling network requests from Canvas-generated code, and disabling Deep Research, Agent Mode, live connectors and file downloads.

Check Point described several abuse scenarios. (1) Zero-click data exfiltration in ChatGPT Classic (the Electron-based desktop app): a malicious GPT could silently leak the entire chat history to attacker-controlled servers, because Classic allowed window.open to execute without a user gesture. (2) Credential theft: attackers could reload content in the main ChatGPT window and force a sign-out, presenting a convincing authentication prompt on an attacker-controlled page. (3) Malware delivery: popups retained the ChatGPT application icon while showing attacker-chosen titles, enabling fake application-update prompts; browser versions auto-downloaded files while Classic required additional clicks. (4) Phishing/malware via shared chat links, which could reach unauthenticated users without any account requirement.

OpenAI deployed a fix on 2026-09-18 by removing allow-popups and allow-popups-to-escape-sandbox from the outer HTML-preview sandbox iframe. Affected: ChatGPT web and ChatGPT Classic. No CVE or CVSS was assigned, and the source reports no in-the-wild exploitation, IOCs or attribution; severity is analyst-assigned. This follows an earlier Check Point disclosure of a DNS-based hidden outbound channel in the ChatGPT code-execution runtime (fixed 2026-02-20).

## MITRE ATT&CK

- T1566.002 Spearphishing Link
- T1204.001 Malicious Link
- T1005 Data from Local System
- T1204.002 Malicious File
- T1036 Masquerading
- T1056.003 Web Portal Capture
- T1213 Data from Information Repositories

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**ChatGPT-Referred Executable/Script/Archive Download (HTML Preview Popup Delivery)** (`TL-2026-5326-SPL-001`)

Behaviour-first detection of the malware-delivery scenario in the ChatGPT HTML preview nested-iframe sandbox escape (TL-2026-5326). Sysmon EventCode 15 Zone.Identifier streams are inspected for a ReferrerUrl or HostUrl of chatgpt.com / chat.openai.com on files with executable, script, installer or archive extensions. Per Check Point Research, browser clients auto-download files from the escaped popup, so a ChatGPT-origin executable download is a strong signal of the fake-application-update lure. No in-the-wild exploitation is reported, so treat this as early warning and hunting content.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1204.002, T1189, T1036
- **Data sources:** sysmon (EventCode 15 FileCreateStreamHash), windows_endpoint
- **Severity:** high
- **Confidence:** medium

### Splunk SPL

```spl
index=sysmon sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=15 TargetFilename="*:Zone.Identifier" earliest=-24h
| where match(Contents, "(?i)(ReferrerUrl|HostUrl)=https?://(www[.])?(chatgpt[.]com|chat[.]openai[.]com)")
| eval downloaded_file=replace(TargetFilename, ":Zone[.]Identifier$", "")
| where match(downloaded_file, "(?i)[.](exe|msi|msix|appx|scr|dll|js|jse|vbs|vbe|hta|ps1|bat|cmd|lnk|iso|img|zip|7z|rar|jar)$")
| stats count min(_time) as first_seen max(_time) as last_seen values(downloaded_file) as files values(Image) as download_client by host, User
| convert ctime(first_seen) ctime(last_seen)
```

### Microsoft KQL

```kql
DeviceFileEvents
| where Timestamp > ago(24h)
| where ActionType == "FileCreated"
| where FileOriginReferrerUrl has_any ("chatgpt.com", "chat.openai.com") or FileOriginUrl has_any ("chatgpt.com", "chat.openai.com")
| where FileName matches regex @"(?i)[.](exe|msi|msix|appx|scr|dll|js|jse|vbs|vbe|hta|ps1|bat|cmd|lnk|iso|img|zip|7z|rar|jar)$"
| project Timestamp, DeviceName, AccountName = InitiatingProcessAccountName, FileName, FolderPath, SHA256, FileOriginUrl, FileOriginReferrerUrl, InitiatingProcessFileName, InitiatingProcessCommandLine
```

### Sigma

```yaml
title: Executable or Archive Downloaded With ChatGPT Referrer
id: 7d1c4a52-3e8b-4f06-9a27-b15e0c8d3a11
status: experimental
description: Detects a file download whose Zone.Identifier referrer or host URL is chatgpt.com or chat.openai.com and whose extension is executable, script or archive. Matches the Check Point Lockdown Mode bypass malware-as-update scenario where a popup escaping the HTML preview sandbox triggers a download.
references:
    - https://research.checkpoint.com/2026/chatgpt-lockdown-mode-bypass-phishing-malware-delivery-and-silent-data-exfiltration/
author: AII-Detector — ThreadLinqs Intelligence
date: 2026-11-05
tags:
    - attack.initial-access
    - attack.t1189
    - attack.execution
    - attack.t1204.002
    - attack.defense-evasion
    - attack.t1036
logsource:
    category: create_stream_hash
    product: windows
detection:
    selection_referrer:
        Contents|contains:
            - 'ReferrerUrl=https://chatgpt.com'
            - 'ReferrerUrl=https://chat.openai.com'
            - 'HostUrl=https://chatgpt.com'
            - 'HostUrl=https://chat.openai.com'
    selection_ext:
        TargetFilename|contains:
            - '.exe:'
            - '.msi:'
            - '.scr:'
            - '.hta:'
            - '.js:'
            - '.vbs:'
            - '.ps1:'
            - '.bat:'
            - '.lnk:'
            - '.iso:'
            - '.zip:'
    condition: selection_referrer and selection_ext
falsepositives:
    - Users legitimately downloading files that ChatGPT generated such as zip archives or ps1 and js samples
    - Developers exporting scripts from ChatGPT code blocks
level: medium

```

**Known false positives:**

- Users legitimately downloading ZIPs, scripts or installers that ChatGPT generated for them (code-interpreter output, ps1/js samples)
- Developers exporting artifacts from ChatGPT code blocks or canvas

**Tuning notes:** Requires Sysmon 13+ with FileCreateStreamHash logging that captures Zone.Identifier Contents. Allowlist code-interpreter output extensions (.zip, .ps1) for developer groups or lower their severity; keep .exe/.msi/.scr/.hta/.iso at high. Correlate hits with the user's ChatGPT session and the downloaded file hash. Chrome and Edge write ReferrerUrl; Firefox may only write HostUrl. The source reports no in-the-wild exploitation, so this is an early-warning rule.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- ChatGPT Lookalike / PoC Attacker Domain Access (Phishing and Fake Update) (locked: unlock with TL Creds)
- Execution Of File Downloaded From ChatGPT Context (Fake Update Executed) (locked: unlock with TL Creds)
- ChatGPT Classic Direct-To-Public-IP Connection (Exfiltration Channel) (locked: unlock with TL Creds)
- ChatGPT Classic Writes Executable/Script/Archive To Disk (locked: unlock with TL Creds)
- Browser Spawning Script Host / LOLBin (Post-Download Execution) (locked: unlock with TL Creds)
- Proxy Download With ChatGPT Referrer (Phishing / Fake Update Delivery) (locked: unlock with TL Creds)
- ChatGPT Classic Spawning Interpreter or LOLBin (User Execution of Fake Update) (locked: unlock with TL Creds)
- ChatGPT Classic Zero-Click Exfiltration - DNS To Non-OpenAI Domain (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sample indicators (2 of 8)

Defanged, TLP:CLEAR.

- Domain: `chatgpt[.]com`
- Domain: `evilwebsite[.]com`

Full set of 8 indicators unlocks with TL Creds: https://threadlinqs.com/tl-creds

## Sources

- [ChatGPT Lockdown Mode Bypass: Phishing, Malware Delivery, and Silent Data Exfiltration (Check Point Research)](https://research.checkpoint.com/2026/chatgpt-lockdown-mode-bypass-phishing-malware-delivery-and-silent-data-exfiltration/)
- [ChatGPT Data Leakage via a Hidden Outbound Channel in the Code Execution Runtime (Check Point Research)](https://research.checkpoint.com/2026/chatgpt-data-leakage-via-a-hidden-outbound-channel-in-the-code-execution-runtime/)
- [ChatGPT gets new security feature to fight prompt injection attacks (Help Net Security)](https://helpnetsecurity.com/2026/02/16/chatgpt-lockdown-mode-elevated-risk)
- [Introducing Lockdown Mode and Elevated Risk labels in ChatGPT (OpenAI)](https://openai.com/index/introducing-lockdown-mode-and-elevated-risk-labels-in-chatgpt/)
- [AI Agent Link Safety (OpenAI)](https://openai.com/index/ai-agent-link-safety/)
- [OpenAI ChatGPT DNS data smuggling flaw (The Register)](https://www.theregister.com/2026/03/30/openai_chatgpt_dns_data_snuggling_flaw/)
- [Check Point Research Reveals ChatGPT Data Exfiltration Flaw (eSecurity Planet)](https://www.esecurityplanet.com/artificial-intelligence/check-point-research-reveals-chatgpt-data-exfiltration-flaw/)
- [ChatGPT Adds Lockdown Mode for Protection Against Prompt Injection Attacks (Privacy Guides)](https://www.privacyguides.org/news/2026/02/21/chatgpt-adds-lockdown-mode-for-protection-against-prompt-injection-attacks/)
- [OpenAI adds Lockdown Mode to ChatGPT to block data theft from prompt injection attacks (The Next Web)](https://thenextweb.com/news/chatgpt-lockdown-mode-prompt-injection)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5326