Disclosed weakness · no CVE recorded

ChatGPT preview could disclose conversation data despite Lockdown Mode

OpenAI · ChatGPT HTML preview and Lockdown Mode

First documented disclosure · Review checkpoint

Summary

Check Point demonstrated disclosure of chat messages during a conversation with a malicious custom GPT, with Lockdown Mode enabled.

Severity and exploitation evidence

No CVSS score recorded in this review.

Exploitation not established: Controlled researcher demonstration. No exploitation against customers was established.

Technical severity is not a measure of observed attacks or of risk to your deployment. Attempts, demonstrations, and successful compromise retain the qualifications in the source.

How the weakness works

Restrictions on network use did not carry over to a new window opened by the HTML preview.

Conditions required

A session had to encounter attacker-controlled content. In the desktop demonstration, disclosure did not require a further click; downloading a file did.

Potential impact

Conversation data could leave the application, and a window could imitate trusted application content.

Affected versions and configurations

The researchers tested the Electron desktop application and described a related web risk. No affected build range was published.

Fix and mitigation status

OpenAI told Check Point on September 18 that it had deployed a fix; Check Point verified that the demonstrated route no longer worked. No fixed client build was specified.

Practical next steps

Keep the client current. Include embedded previews and new windows when testing restrictions on external requests.

Operating lesson

Apply the same outbound data policy to every surface that can render chat content.

Evidence and limits

November 5 is the public research date. September 18 was a private remediation notice, not the public disclosure date. No exact CVE or numerical severity was established.

Related incident and research records

Related records can include laboratory demonstrations; a relationship does not itself establish exploitation.

Sources