Nested Frame Popup Escape Bypassed ChatGPT Lockdown Mode Sandbox

The vulnerability resided in HTML preview rendering inside code blocks. Nested sandboxed iframes were intended to block outbound requests and cookie access, yet the popup permission set still permitted a second nested frame to invoke an unmodified window.open, escaping the outer sandbox and Lockdown Mode network controls. This path allowed crafted prompts or shared chats to trigger zero-click data theft or phishing lures in the Electron client. Check Point's report and Parameter Labs' concurrent disclosure both trace to the same UI component. Parameter Labs showed an attacker-controlled share link could auto-execute under chatgpt.com origin once the preview rendered; Check Point mapped the additional sandbox breakout. OpenAI patched the flaw on 18 September 2026 after coordinated disclosure, confirming the root cause was insufficient isolation between preview frames and popup APIs. The pattern is familiar: security boundaries added to the model layer are undermined by legacy rendering code in the surrounding application. Lockdown Mode assumed HTML previews would remain confined; the implementation did not enforce that assumption across all popup paths. Similar gaps have appeared in prior Electron-based tools where CSP and sandbox settings diverged. Enterprises relying on AI clients must now treat UI rendering surfaces as first-class attack surfaces. OpenAI has not published the revised sandbox configuration or committed to third-party audits of the preview code; independent verification of the fix remains unavailable.