Check Point Research has disclosed a repaired flaw in ChatGPT’s HTML previews that undermined Lockdown Mode. Its demonstration used a malicious GPT to send chat messages to an external server without an additional click in the Electron-based ChatGPT Classic desktop application.
The November 5 disclosure describes an issue that OpenAI had already addressed. According to Check Point, OpenAI notified the researchers on September 18, 2026 that a fix was deployed; subsequent testing confirmed the technique no longer worked.
A preview window crossed the boundary
Nested preview frames could reach popup functionality that bypassed interception. Sandbox permissions allowed the new window to escape its restrictions.
Check Point says the underlying technique was not limited to desktop use. Phishing and fake-update scenarios were also described, but desktop file downloads still required a click. Zero-click refers to the demonstrated data leak after interacting with malicious content.
This is a research disclosure, not confirmation of a customer breach. The evidence reviewed does not establish how many users were exposed or whether attackers exploited this path outside the demonstration.
What teams should take from the finding
For security teams, the practical lesson is about where trust is enforced. An AI assistant may generate an ordinary-looking answer while another part of its interface handles active content. Reviewing the answer alone cannot establish whether that content stayed within the intended boundary.
Organizations evaluating AI tools should include preview windows, desktop clients and third-party GPTs in their assessment. A useful question for vendors is how they test newly added rendering features against existing restrictions, including differences between browser and desktop behavior.
Employees should also have clear rules for which business information they may place in external assistants. That limits potential exposure across future vulnerabilities, even when a protective mode is enabled. This recommendation is a broader security interpretation of the finding; it is not evidence that this repaired technique remains exploitable.
