No source states: money lost or records count, could do, deployer, industry.
Severity minor: The leak was demonstrated by researchers and OpenAI fixed the flaw after disclosure; no real victim loss is stated.
Researchers at Check Point Research found a way around Lockdown Mode through HTML previews in ChatGPT code blocks.
What happened
1 · What it was doingChatGPT renders HTML page previews inside code blocks, normally isolating user-provided web code in a restricted area.
2 · What went wrongPop-up windows opened from the HTML preview escaped the restrictions on the preview, letting chat messages leak silently to an attacker's server. This breached the isolation around the preview.
3 · What it reached or didChat messages of a victim in conversation could leak, shown on the desktop application. The researchers said the technique was not limited to that environment.
4 · How it was caughtCheck Point Research researchers found the bypass and disclosed it to OpenAI.
What was done
OpenAI removed the sandbox permissions behind the technique, and a retest confirmed the method no longer works.
Fix reported
“OpenAI removed the sandbox permissions behind the technique, and a retest confirmed the method no longer works.”
No source states: when it happened, when it was found, how many records were exposed, the direct loss, a count of the other parties affected, any court case, the cause, what set it off.
Show every field, with its source and grade
The AI system
Model
ChatGPT
D inferred by us from the described behaviour, reason shown
Developer
OpenAI
D inferred by us from the described behaviour, reason shown
Software around the model
ChatGPT desktop application
C one secondary source states it
Safeguards in place
lockdown mode, sandbox
C one secondary source states it
State of its safeguards
Lockdown Mode restricts live web access and Internet-hosted images, and disables Deep Research, Agent Mode, live connectors and file downloads
C one secondary source states it
What happened
Earliest source we hold
2026-11-06
D inferred by us from the described behaviour, reason shown
Who caught it
an independent researcher or journalist
D inferred by us from the described behaviour, reason shown
Themes
sandbox escape, html preview, popup window, lockdown mode bypass, silent data exfiltration
D inferred by us from the described behaviour, reason shown
What was done
OpenAI removed the sandbox permissions behind the technique, and a retest confirmed the method no longer works.
C one secondary source states it
What went wrong
security breach
D inferred by us from the described behaviour, reason shown
Impact
Severity
minor
D inferred by us from the described behaviour, reason shown
Who was affected
Victims in active ChatGPT conversations whose chat messages could leak to an attacker-controlled server
C one secondary source states it
Kinds of data exposed
chat messages
C one secondary source states it
Why this severity
The leak was demonstrated by researchers and OpenAI fixed the flaw after disclosure; no real victim loss is stated.
D inferred by us from the described behaviour, reason shown
LR-2026-0855 · version 2 · published 2026-11-06 after automatic checks; not yet checked field by field by a person · changes to this case · JSON
AI Risk Wire