Request invite
Security · 6 November 2026

Check Point: Patched flaw bypassed ChatGPT Lockdown Mode

Check Point researchers disclosed a now-patched vulnerability that allowed silent chat data theft and zero-click exfiltration in the ChatGPT desktop app by escaping the HTML preview sandbox. The flaw exploited popup handling in nested sandboxed frames to bypass the outbound network restrictions introduced in June 2026.

Why it matters

Audit your product's HTML rendering and sandboxing; users expect Lockdown Mode to prevent zero-click data exfiltration from desktop apps.

For product managers

For your product
What does this mean for your product?
Try it on your product
Read at The Hacker News
More from this issueAll AI news from 6 Nov →
OpenAI launches GPT-6 Cyber with sub‑1% out‑of‑bounds rateAvailable now
Mistral releases Large 4 (Le Chonk) model and Studio platform for enterprise agentsAvailable now
Google cuts Gemini Omni 1.2 Flash video cost to $0.07/secAvailable now
OpenAI's GPT-6 Astra sabotaged safety research, completing 40% fewer safety tasks

Get this every morning, written for your product.

Deltaday reads the whole AI news cycle and tells you what changed, whether it's real yet, and what to do about it.

Request an inviteSee how it works