Vulnerability / research

Check Point shows ChatGPT previews could expose chat data with Lockdown Mode enabled

Reported

Published here

What happened

Check Point demonstrated that an HTML preview could send conversation data outside ChatGPT even when Lockdown Mode restricted outbound access. Its desktop demonstration required no user interaction to send the data.

Parties and reporting

AI tools and systems: ChatGPT Lockdown Mode, HTML preview sandbox, ChatGPT Desktop

Outcome

OpenAI told Check Point on September 18 that it had changed the preview permissions. The researchers retested the issue and confirmed their method no longer worked.

Operating lesson

Test preview windows and desktop clients when verifying whether a privacy setting blocks outbound data.

Evidence and limits

November 5 dates the public research report. September 18 dates private confirmation of the fix. This was a controlled demonstration with no disclosed victim or documented malicious use.

Sources