{"schema_version":"0.10.0","id":"LR-2026-0855","record_version":2,"title":"Check Point Research: HTML-preview bypass of ChatGPT Lockdown Mode, fixed by OpenAI after disclosure","verification":{"human_verified":false,"method":"automated_gate","auto_verified":true,"score":50.3,"score_breakdown":{"source_authority":12.1,"independent_corroboration":7.0,"implicated_party_confirmed":0.0,"citation_integrity":14.0,"specificity":3.0,"completeness":6.72,"unhedged_language":5.0},"checks":{"schema_valid":true,"every_field_cited":true,"quotes_verbatim":true,"source_fetched":true,"distinct_incident":true,"dates_plausible":true,"sources_agree":true,"source_describes_incident":true,"severe_backed_by_source":true,"record_integrity":true,"eligible":true,"about_this_case":true},"gate_version":"gate-2026-10-18.7","cross_check_model":null,"cross_check_agreement":null,"duplicate_of":null,"verified_by":null,"verified_at":"2026-11-06","extraction_run_id":null,"evidence_level":{"level":"preliminary","reason":"1 report: BusinessLine · subject to change","original_document":null,"reports_total":1,"reports_independent":1,"reports_derivative":0,"developing":true,"disputed":false,"rules_version":"evidence-2026-10-29.1","computed_at":"2026-11-06","history":[{"date":"2026-11-06","from_level":null,"to_level":"preliminary","reason":"1 report: BusinessLine · subject to change"}]},"sources_hash":"aff504a267437d1e516620e97daffbd4511e6c58b8d8125055e259641d035a07"},"system":{"model_name":"ChatGPT","model_version":null,"developer":"OpenAI","harness":"ChatGPT desktop application","tools_granted":[],"permissions_scope":null,"autonomy_level":"unknown","guardrails_present":["lockdown_mode","sandbox"],"deployment_context":"unknown","tier":null,"lifecycle_stage":null,"integration_type":null,"intended_use":null,"safeguard_state":"Lockdown Mode restricts live web access and Internet-hosted images, and disables Deep Research, Agent Mode, live connectors and file downloads","production_intended":null},"event":{"date_occurred":null,"date_disclosed":"2026-11-06","incident_class":"security_compromise","failure_class":null,"agent_involved":null,"secondary_failure_classes":[],"trigger":"unknown","duration":null,"detection_method":"public_researcher","summary":"Researchers at Check Point Research found a way around Lockdown Mode through HTML previews in ChatGPT code blocks.","tags":["sandbox-escape","html-preview","popup-window","lockdown-mode-bypass","silent-data-exfiltration"],"date_detected":null,"near_miss":null,"root_cause":null,"root_cause_detail":null,"failure_class_detail":null,"responsible_party":null,"adversarial_actor":null,"input_provenance":null,"time_to_contain":null,"operations_paused":null,"remediation":"OpenAI removed the sandbox permissions behind the technique, and a retest confirmed the method no longer works.","precursor_events":null},"impact":{"direct_loss_usd":null,"remediation_hours":null,"records_exposed":null,"third_parties_affected_count":null,"severity":"minor","severity_because":"minor: The leak was demonstrated by researchers and OpenAI fixed the flaw after disclosure; no real victim loss is stated.","harm_class":[],"affected_description":"Victims in active ChatGPT conversations whose chat messages could leak to an attacker-controlled server","protected_class_involved":null,"data_categories_exposed":["chat messages"],"loss_range_usd":null,"reversibility":null,"downstream_exposure_count":null},"evidence":{"sources":[{"url":"https://www.thehindubusinessline.com/info-tech/check-point-finds-vulnerability-in-chatgpts-lockdown-mode/article71674875.ece","publisher":"BusinessLine","date":"2026-11-06","type":"press","title":"Check Point finds vulnerability in ChatGPT’s Lockdown Mode","archived_url":null,"attachment":"first_report","independence":"independent"}],"per_field_confidence":{"system.model_name":"D","system.harness":"C","system.guardrails_present":"C","system.safeguard_state":"C","system.developer":"D","system.autonomy_level":"D","system.deployment_context":"D","event.tags":"D","event.remediation":"C","event.incident_class":"D","event.detection_method":"D","event.summary":"D","event.date_disclosed":"D","event.trigger":"D","impact.affected_description":"C","impact.data_categories_exposed":"C","impact.severity":"D","context.denominator_available":"D","context.country":"D","impact.severity_because":"D"},"field_citations":{"system.developer":[{"source_index":0,"quote":"OpenAI introduced Lockdown Mode as an optional setting against prompt injection, where malicious instructions hidden in content an AI system processes push it into an unintended action."}],"system.model_name":[{"source_index":0,"quote":"ChatGPT’s Lockdown Mode, which restricts features on the Gen AI platform to reduce the risk of malicious instructions causing sensitive data to leak, was found to have an Achilles’ heel."}],"system.harness":[{"source_index":0,"quote":"While the demonstration used the desktop application, the researchers said the underlying technique was not limited to that environment."}],"system.safeguard_state":[{"source_index":0,"quote":"The mode restricts live web access and Internet-hosted images, and disables Deep Research, Agent Mode, live connectors and file downloads."}],"system.guardrails_present":[{"source_index":0,"quote":"The mode restricts live web access and Internet-hosted images, and disables Deep Research, Agent Mode, live connectors and file downloads."},{"source_index":0,"quote":"ChatGPT usually isolates user-provided web code in a secure, restricted area separated from the rest of the app, to mitigate the risks associated with running it."}],"event.incident_class":[{"source_index":0,"quote":"The researchers found a way to open pop-up windows that were not subject to the same restrictions as the HTML preview."}],"event.detection_method":[{"source_index":0,"quote":"Researchers at Check Point Research found a way around it through HTML previews that enables silent data theft, phishing and malware delivery."}],"event.remediation":[{"source_index":0,"quote":"On September 18, it told them it had removed the sandbox permissions behind the technique, and a retest confirmed the method no longer works."}],"event.tags":[{"source_index":0,"quote":"The researchers found a way to open pop-up windows that were not subject to the same restrictions as the HTML preview."}],"event.summary":[{"source_index":0,"quote":"Researchers at Check Point Research found a way around it through HTML previews that enables silent data theft, phishing and malware delivery."}],"impact.data_categories_exposed":[{"source_index":0,"quote":"Using a malicious GPT, the researchers showed how chat messages could leak silently to an attacker-controlled server while the victim was in conversation."}],"impact.affected_description":[{"source_index":0,"quote":"Using a malicious GPT, the researchers showed how chat messages could leak silently to an attacker-controlled server while the victim was in conversation."}],"impact.severity":[{"source_index":0,"quote":"OpenAI, however, fixed the vulnerability after the researchers disclosed it."}],"impact.severity_because":[{"source_index":0,"quote":"OpenAI, however, fixed the vulnerability after the researchers disclosed it."}]},"notes_on_gaps":"No source states event.trigger, date_occurred, the operator's autonomy level, or tools granted. Deployment context is not stated, so it is omitted rather than classed as evaluation. The severity tier is grade D: the sources do not say whether any real third party was affected, and no loss figure is given. Failure_class is omitted because no autonomous agent action is described. The sources give no third-party count, and a count of 0 is not asserted. Root cause is classified as integration from the sandbox-permissions fix. event.root_cause: the stated reason names an absence, not a failed control: The source attributes the issue to how ChatGPT handles HTML page previews inside code blocks; pop-up windows were not subject to the same restrictions as the HTML preview. system.tier: not set; no operator named and deployment_context is not a lab's. [aggregated by claude-sonnet-5-5, aggregate-2026-09-27.1, 2026-11-06] system.model_name: classified from described behaviour. system.developer: classified from described behaviour. system.autonomy_level: no source states the arrangement. system.deployment_context: no source states where it ran. event.tags: classified from described behaviour. event.incident_class: a source states an attacker, an injected instruction or a misused credential caused the system to act, or that the system's own boundary (sandbox, permissions, weights, accounts) was breached. event.detection_method: classified from described behaviour. event.summary: classified from described behaviour. event.date_disclosed: the date the source's feed lists; no sentence in the article we hold states it. event.trigger: no source states a cause. context.denominator_available: no denominator is available for this incident. context.country: no source states the operator's location."},"context":{"industry":null,"org_size_band":null,"country":"unknown","denominator_available":false,"denominator":null,"related_incident_ids":[],"systemic_exposure":null,"shared_model_id":null,"upstream_incident_id":null,"incident_evidence":null,"regulatory":null,"coverage":null},"narrative":{"steps":[{"step":"doing","text":"ChatGPT renders HTML page previews inside code blocks, normally isolating user-provided web code in a restricted area. The operator and tool access are not named beyond the desktop application.","quote":"ChatGPT usually isolates user-provided web code in a secure, restricted area separated from the rest of the app, to mitigate the risks associated with running it.","source_index":0,"grade":"C"},{"step":"went_wrong","text":"Pop-up windows opened from the HTML preview escaped the restrictions on the preview, letting chat messages leak silently to an attacker's server. This breached the isolation around the preview.","quote":"The researchers found a way to open pop-up windows that were not subject to the same restrictions as the HTML preview.","source_index":0,"grade":"C"},{"step":"reached","text":"Chat messages of a victim in conversation could leak, shown on the desktop application. The researchers said the technique was not limited to that environment.","quote":"While the demonstration used the desktop application, the researchers said the underlying technique was not limited to that environment.","source_index":0,"grade":"C"},{"step":"caught","text":"Check Point Research researchers found the bypass and disclosed it to OpenAI.","quote":"Researchers at Check Point Research found a way around it through HTML previews that enables silent data theft, phishing and malware delivery.","source_index":0,"grade":"C"},{"step":"done","text":"OpenAI removed the sandbox permissions behind the technique, and a retest confirmed the method no longer works.","quote":"On September 18, it told them it had removed the sandbox permissions behind the technique, and a retest confirmed the method no longer works.","source_index":0,"grade":"C"}],"model":"claude-sonnet-5-5","prompt_version":"aggregate-2026-09-27.1","extracted_at":"2026-11-06","source_urls":["https://www.thehindubusinessline.com/info-tech/check-point-finds-vulnerability-in-chatgpts-lockdown-mode/article71674875.ece"]}}