Check Point reports a ChatGPT Lockdown Mode bypass, and OpenAI has fixed it
The flaw was in the HTML preview for code blocks, and OpenAI fixed it on its servers on 18 September.
Researchers found a way around a safety setting in ChatGPT. The company fixed it in September, and you do not need to do anything.
Sept 18date OpenAI fixed it
Hype check
Hype3
Real3
The noise matches the real change.
Our editorial opinion, based on the sources below. How we score
Why it matters
You need to do nothing, since the fix was made by OpenAI, but it is a reminder that security settings need testing.
For most people
Watch: it is fixed and nothing is needed from you.
The details
- Check Point Research published its report on 5 November.
- Lockdown Mode is an optional setting meant to stop data leaks through prompt injection.
- The cause was an HTML preview added to code blocks in February 2026, whose popup window Lockdown Mode did not cover.
- In the browser the victim had to click the preview; in the ChatGPT Classic desktop app no click was needed.
- OpenAI fixed it on 18 September and Check Point confirmed the technique no longer works. The fix is on the server side.
WatchNo action needed from you.
Receipts
One trusted outlet reports it. Not confirmed yet. Open the sources and check us.
Written with the help of AI tools and checked against the sources above. How we work
See a mistake? Tell us and we’ll fix it.
