Confirmed

Check Point found a now-patched way around ChatGPT Lockdown Mode

The flaw allowed silent chat data theft, phishing and malware delivery, the researchers say.

Leaked on 08 November 2026

A smartphone running the ChatGPT app. Photo: Jernej Furman from Slovenia / Wikimedia Commons, cropped (CC BY 2.0)

Check Point Research disclosed a now-patched vulnerability that could bypass Lockdown Mode protections in ChatGPT, The Hacker News reported. @The_Cyber_News shared the findings on X.

Cyber Security News @The_Cyber_News

‼️ Hackers Could Bypass ChatGPT Lockdown Mode to Steal Conversations Without Users Knowing Details: https://t.co/CSjocVgzKD A flaw in ChatGPT let attackers slip past Lockdown Mode, the safety setting meant to stop data leaks. Check Point Research found that a hidden pop-up trick could copy a user’s full chat history, show fake windows, and push malware. In the ChatGPT Classic desktop app, simply chatting was enough to trigger the leak. OpenAI launched Lockdown Mode on February 13, 2026, first for business plans. On June 4, it reached personal accounts, where users can turn it on under Settings > Security. #cybersecuritynews

269 likes · 75 reposts · counts as of 09 Nov 2026, 12:49 UTC

— Cyber Security News (@The_Cyber_News) November 8, 2026

not in our leaker index

"The flaw could enable silent chat data theft, phishing, and malware delivery, including zero-click data exfiltration in the ChatGPT desktop application," Eli Smadja, head of research at Check Point, said, according to The Hacker News. The problem stemmed from HTML previews inside ChatGPT code blocks.

Check Point published the research, and the vulnerability has been patched.

Sources

Status key: how we label leaks · Corrections · Contact