ChatGPT Lockdown Mode Bypassed, Enabling Data Exfiltration and Phishing
Check Point Research has discovered a critical vulnerability allowing attackers to bypass ChatGPT's Lockdown Mode, enabling silent data exfiltration, credential theft, and malware delivery.
OpenAI's recently introduced Lockdown Mode, designed to bolster user privacy by preventing prompt injection attacks from exfiltrating sensitive data, has been found to be bypassable. Researchers at Check Point discovered a flaw that effectively neutralizes the security feature, opening the door to significant data leakage and other malicious activities.
Lockdown Mode was implemented to mitigate risks associated with prompt injection, a technique where attackers trick AI models into performing unintended actions. These actions could include making outbound web requests or downloading files, potentially exposing private conversation data. The mode restricts live web access, blocks external images, disables network requests from specific code, and turns off advanced features like Agent Mode and live connectors.
The newly identified vulnerability exploits the HTML page preview feature introduced in ChatGPT code blocks. This feature, while intended for displaying code snippets, can be manipulated. Attackers can embed malicious HTML that, when rendered, can trigger data exfiltration without any user interaction, particularly in the "ChatGPT Classic" interface. This means an entire chat history could be silently sent to an attacker-controlled server.
Beyond data exfiltration, the bypass allows for more sophisticated attacks. Attackers can craft prompts that display arbitrary content within the ChatGPT interface, including phishing messages or convincing social engineering lures. This could lead to credential theft if users are tricked into entering sensitive information into fake login forms presented within the AI's chat window.
Furthermore, the vulnerability can be leveraged for malware delivery. By embedding links to malicious executable files within the rendered HTML, attackers can trick users into downloading and running malware. The attack can be initiated through a malicious prompt, a compromised GPT, or even a shared chat, broadening the potential attack surface.
The technical details reveal that the exploit targets the sandbox environment designed to isolate rendered HTML content. While safeguards are in place, specific permissions like "allow-popups" and "allow-popups-to-escape-sandbox" were found to be permissive enough to be abused. The researchers demonstrated how the window.open function could be redefined to allow popups, which ChatGPT typically intercepts for user approval, but this mechanism can be circumvented.
This bypass underscores the ongoing challenges in securing AI models and their interfaces. Despite OpenAI's efforts to implement robust security features like Lockdown Mode, sophisticated attackers continue to find novel ways to exploit underlying functionalities. The ability to silently exfiltrate data, conduct phishing attacks, and distribute malware directly through the ChatGPT interface poses a significant threat to users and their sensitive information.
OpenAI has been notified of the vulnerability, and users are advised to exercise caution when interacting with ChatGPT, especially when encountering unexpected pop-ups or links, even if Lockdown Mode is enabled. The research highlights the critical need for continuous security auditing and rapid patching of AI platforms.