Check Point bypasses ChatGPT's Lockdown Mode to silently extract chat histories
Researchers say the flaw made the optional protection against prompt-injection data theft ineffective. In ChatGPT Classic, the attack needed no user interaction.
Evidence: Independent reports. Security stories run only with a named disclosure or independent reporting behind them.
Check Point Research says it found a vulnerability that let attackers bypass Lockdown Mode in ChatGPT. Lockdown Mode is an optional advanced security setting that OpenAI recently introduced to protect sensitive user data from prompt-injection attacks that exfiltrate data. In a report by researcher Alexey Bukhteyev, Check Point says the bypass made Lockdown Mode's core protections ineffective. The company says the flaw opened a wide attack surface. It allowed silent exfiltration of a user's entire chat history, credential theft through phishing, and delivery of malware. In ChatGPT Classic, the attack needed no user interaction: having a conversation was enough to trigger the silent data theft. The Hacker News also reported the research and said chats could be exfiltrated without user interaction. The supplied excerpts do not say whether OpenAI has fixed the issue or when Check Point reported it. The finding matters most for people who switched on Lockdown Mode because they handle sensitive information. They chose the setting specifically to block this kind of data theft. The research also shows how hard it remains to defend chat assistants against prompt injection when they can read outside content.