OpenAI has patched two separate ChatGPT security vulnerabilities that could allow attackers to access private conversations, bypass security protections, and steal sensitive information through malicious content.
The flaws, discovered by cybersecurity researchers at Parameter and Check Point Research, exploited different weaknesses in ChatGPT’s HTML Preview feature, which allows interactive webpage content to appear inside conversations.
The latest findings, disclosed on November 5, 2026, revealed that attackers could bypass ChatGPT’s Lockdown Mode and potentially steal conversation data without additional user interaction. The disclosure followed an earlier investigation showing how malicious shared ChatGPT links could execute code inside another user’s authenticated session.
Both vulnerabilities were fixed before their public disclosure.
How a Malicious ChatGPT Link Could Expose Private Conversations
The first vulnerability, disclosed by Parameter on October 28, allowed attackers to create malicious shared ChatGPT conversations capable of accessing private information from signed-in users who opened the link.
The attack exploited an interaction between ChatGPT’s HTML Preview feature and MathLive, a mathematical component loaded when certain interactive graphs appeared in a conversation.
Researchers discovered that MathLive accepted browser messages without properly verifying their origin. This allowed malicious content inside the restricted Preview environment to send instructions to components operating on the main ChatGPT webpage.
The attackers then bypassed additional browser security restrictions using a YouTube endpoint permitted by ChatGPT’s Content Security Policy, allowing their JavaScript to execute within the victim’s authenticated session.
In a controlled demonstration, Parameter retrieved a victim account’s recent conversation list, accessed a separate private conversation that had never been publicly shared, and transmitted part of its contents to an external server.
The attack used legitimate ChatGPT sharing links, making malicious conversations appear trustworthy. An early version required victims to click the Preview button, but researchers later developed a variant that executed automatically when the shared conversation opened.
Because the injected code operated within the user’s authenticated session, Parameter said the vulnerability could potentially enable other actions available through ChatGPT’s web interface.
Researchers Bypass ChatGPT Lockdown Mode
A separate investigation by Check Point Research uncovered another weakness in HTML Preview that allowed attackers to bypass restrictions intended to prevent unauthorized data transfers.
HTML Preview normally runs webpage content inside an isolated environment called a sandbox. This prevents potentially malicious code from directly accessing sensitive application data or communicating with external servers without permission.
However, Check Point discovered a weakness in how the sandbox handled popup windows. Although ChatGPT blocked direct attempts to open external windows, certain browser permissions still allowed attackers to create popups that escaped those restrictions.
By exploiting this behavior, researchers bypassed ChatGPT’s Lockdown Mode, an optional advanced security setting designed to limit external network access and reduce the risk of sensitive information being leaked through malicious instructions.
The vulnerability was particularly concerning in the Electron-based ChatGPT Classic desktop application, where researchers demonstrated that malicious content could open popup windows without requiring an additional click or approval.
In a controlled test, Check Point used a malicious custom GPT to silently transmit chat messages to an attacker-controlled server while the user interacted with the application.
Researchers said the underlying weakness could also be exploited through malicious prompts and shared conversations, although the attack’s behavior depended on how ChatGPT was accessed.
Flaw Also Created Phishing and Malware Risks
Beyond conversation data theft, Check Point found that the vulnerability could be used to display convincing phishing messages inside windows that appeared to belong to ChatGPT.
Researchers demonstrated how a malicious popup could imitate a legitimate application update, potentially tricking users into downloading malware. In the desktop application, these windows retained the ChatGPT icon while allowing attackers to control their titles and content.
The vulnerability also allowed researchers to forcibly sign users out of ChatGPT, creating an opportunity to direct them to a fraudulent login page designed to steal account credentials.
Unlike the demonstrated silent data theft, these phishing and malware-delivery scenarios generally required additional user actions, such as clicking a malicious link or entering login credentials.
OpenAI addressed the two vulnerabilities through separate security updates.
According to Check Point, OpenAI confirmed a fix for the Lockdown Mode bypass on September 18, which removed the popup permissions that allowed malicious content to escape HTML Preview’s sandbox.
Parameter reported its separate vulnerability to OpenAI on October 18. It was classified it as a high-priority P1 security problem, and fixes were deployed across the affected ChatGPT web frontend versions. The updated application rejected the malicious browser messages that enabled the attack.
Neither investigation established that attackers had exploited the vulnerabilities against real users outside controlled research.
The two discoveries do demonstrate how weaknesses in the browser components surrounding an AI assistant can undermine protections designed to keep private conversations secure, even when the underlying content is running inside a restricted environment.
Leave a Reply