Researchers Bypass ChatGPT ChatGPT to Exfiltrate Chats Without User Interaction
ChatGPT has published findings on a flaw in how ChatGPT-style agents handle untrusted input.
ChatGPT has published findings on a flaw in how ChatGPT-style agents handle untrusted input.
Cybersecurity researchers have disclosed details of a now-patched vulnerability that could be exploited to bypass ChatGPT protections in OpenAI ChatGPT.
ChatGPT was introduced by the artificial intelligence (AI) company in June 2026 as an optional setting to minimize data exfiltration risks arising from prompt injections.
Eli Smadja, head of research at Check Point, said in a report shared with the outlet.
However, Check Point found a loophole in the manner popup windows are handled during HTML previews that made it possible to escape the confines of the sandbox and bypass ChatGPT.
Following responsible disclosure, the vulnerability was addressed by OpenAI on September 18, 2026.
Any organization running ChatGPT-style agents on the affected workflow is potentially exposed, not just the specific product named in the research.
The sandbox also prevents the rendered content from communicating with external resources without user consent.
What's more, as the attacker is in complete control of the content displayed in the popup window, it could be used to render convincing social-engineering lures, such as a fake ChatGPT update, and trick the victim into downloading malware by persuading them to click on a link.
The danger here is that the exfiltration path hides inside normal business activity, so a control built to catch obvious attacks has nothing unusual to flag.
ChatGPT acts as a security barrier, mitigating data exfiltration risk by limiting outbound network requests that could be used to transfer sensitive information to an attacker-controlled infrastructure.
By creating another nested frame within the rendered page, it was possible to access an unmodified popup function and bypass the restrictions placed on the original HTML preview.
ChatGPT's research describes a specific attack chain rather than a generic weakness, meaning the fix has to address that chain directly.
Content opened through this route was no longer subject to the same sandbox restrictions, providing a way to circumvent the protections of ChatGPT. Once the restrictions are bypassed, a threat actor can exploit the vulnerability to exfiltrate data, chat messages, or deliver malicious payloads by means of a crafted prompt, a malicious GPT, or a shared chat.
The disclosure comes a week after Parameter Labs detailed a way to bypass ChatGPT's sandbox and content security policy (CSP) and take over anyone's account simply by sending an attacker-controlled public ChatGPT share link and prompting them to click the HTML preview once.
If the HTML block is marked as previewable, it's opened automatically.
Check Point told the outlet that the two shortcomings are different vulnerabilities on the same component, with the takeover bug enabling Javascript code execution outside of the sandbox so as to make the victim call out chatgpt[.]com and perform API requests on behalf of the victim the company said in a statement.
Earlier this September, Check Point also demonstrated a covert cross-account command channel through which an attacker could use a victim's ChatGPT session to run hidden tasks with the tools, data, and connected apps available to that session, alongside the visible conversation.
Review whether any agent in your environment processes untrusted or externally-submitted content as part of its normal workflow, since that is the pattern this kind of attack chain relies on.
Confirm outbound data-handling controls actually inspect what an agent sends, not just where it sends it, since DNS- and URL-based exfiltration techniques are built to slip past destination-based controls specifically.
What happened
ChatGPT has published findings on a flaw in how ChatGPT-style agents handle untrusted input.
Cybersecurity researchers have disclosed details of a now-patched vulnerability that could be exploited to bypass ChatGPT protections in OpenAI ChatGPT.
ChatGPT was introduced by the artificial intelligence (AI) company in June 2026 as an optional setting to minimize data exfiltration risks arising from prompt injections.
What changed
Eli Smadja, head of research at Check Point, said in a report shared with the outlet.
However, Check Point found a loophole in the manner popup windows are handled during HTML previews that made it possible to escape the confines of the sandbox and bypass ChatGPT.
Following responsible disclosure, the vulnerability was addressed by OpenAI on September 18, 2026.
Who is affected
Any organization running ChatGPT-style agents on the affected workflow is potentially exposed, not just the specific product named in the research.
The sandbox also prevents the rendered content from communicating with external resources without user consent.
What's more, as the attacker is in complete control of the content displayed in the popup window, it could be used to render convincing social-engineering lures, such as a fake ChatGPT update, and trick the victim into downloading malware by persuading them to click on a link.
Why it matters
The danger here is that the exfiltration path hides inside normal business activity, so a control built to catch obvious attacks has nothing unusual to flag.
ChatGPT acts as a security barrier, mitigating data exfiltration risk by limiting outbound network requests that could be used to transfer sensitive information to an attacker-controlled infrastructure.
By creating another nested frame within the rendered page, it was possible to access an unmodified popup function and bypass the restrictions placed on the original HTML preview.
Technical details
ChatGPT's research describes a specific attack chain rather than a generic weakness, meaning the fix has to address that chain directly.
Content opened through this route was no longer subject to the same sandbox restrictions, providing a way to circumvent the protections of ChatGPT. Once the restrictions are bypassed, a threat actor can exploit the vulnerability to exfiltrate data, chat messages, or deliver malicious payloads by means of a crafted prompt, a malicious GPT, or a shared chat.
The disclosure comes a week after Parameter Labs detailed a way to bypass ChatGPT's sandbox and content security policy (CSP) and take over anyone's account simply by sending an attacker-controlled public ChatGPT share link and prompting them to click the HTML preview once.
Response
If the HTML block is marked as previewable, it's opened automatically.
Check Point told the outlet that the two shortcomings are different vulnerabilities on the same component, with the takeover bug enabling Javascript code execution outside of the sandbox so as to make the victim call out chatgpt[.]com and perform API requests on behalf of the victim the company said in a statement.
Earlier this September, Check Point also demonstrated a covert cross-account command channel through which an attacker could use a victim's ChatGPT session to run hidden tasks with the tools, data, and connected apps available to that session, alongside the visible conversation.
What security teams should do
Review whether any agent in your environment processes untrusted or externally-submitted content as part of its normal workflow, since that is the pattern this kind of attack chain relies on.
Confirm outbound data-handling controls actually inspect what an agent sends, not just where it sends it, since DNS- and URL-based exfiltration techniques are built to slip past destination-based controls specifically.