Check Point Research has shown a way around ChatGPT Lockdown Mode that could send a user’s chats to an attacker without a single click. OpenAI had fixed it by September 18, and Check Point published the details on November 5, 2026. The same week, Forever Security showed that a malicious browser extension on claude.ai could drive Claude Desktop through Dispatch.
Both findings involve features that users trust. Lockdown Mode exists to reduce data theft from prompt injection. Dispatch was built so you could send tasks to your own computer. In each case, something outside the user’s control could use that trust.
The short version: the ChatGPT Lockdown Mode bypass is patched, and there is nothing to install. The Dispatch issue has no fix, according to the researcher. Anthropic told the researcher it would retire Dispatch, but as of November 8 it still runs for existing users. The practical steps are the same for both: control browser extensions, know what Lockdown Mode does not cover, and keep personal AI accounts off work computers.
What Check Point found in ChatGPT Lockdown Mode
Check Point’s research post by Alexey Bukhteyev starts with a feature ChatGPT added in February 2026. Code blocks can show a rendered preview of HTML. That preview runs inside a sandbox built from two nested frames.
According to Check Point, the outer frame still allowed pop-up windows, and those pop-ups could escape the sandbox. ChatGPT had blocked the page’s own way of opening a window. The researcher created a frame inside the preview and opened a window from there instead. Content in that window ran outside the sandbox.
Check Point lists three ways to deliver the attack: a malicious prompt, a malicious GPT or a shared chat. Once outside the sandbox, an attacker could do three things, per the post:
- Send the user’s chat history and uploaded files to an outside server.
- Show a fake sign-in or sign-out screen to steal credentials.
- Show a fake ChatGPT update window that delivers malware.
The zero-click part applied to ChatGPT Classic, the Electron-based desktop app. Check Point says that there, "simply having a conversation is enough to trigger silent data exfiltration." The browser version was also affected.
How OpenAI fixed the ChatGPT Lockdown Mode bypass
Check Point says OpenAI told it on September 18, 2026, that a fix was in place. OpenAI removed the pop-up permissions from the outer preview frame. Check Point retested and confirmed the technique no longer works.
The post does not say when Check Point first reported the flaw. It also does not include a statement from OpenAI. The fix changed how ChatGPT itself serves the preview, so users and admins have nothing to patch for this specific issue.
What ChatGPT Lockdown Mode does, and what it does not
OpenAI’s Lockdown Mode help article describes it as "an optional advanced security setting." It is meant for people and organizations that handle sensitive data. Its job is to limit outbound network requests that could carry data to an attacker.
The article says ChatGPT Lockdown Mode limits or turns off these features:
| Feature | In ChatGPT Lockdown Mode | Source |
|---|---|---|
| Live web browsing | Limited to cached content | OpenAI help article |
| Images in responses | May not display; image generation still works | OpenAI help article |
| Deep research and agent mode | Turned off | OpenAI help article |
| Canvas code network access | Cannot be approved | OpenAI help article |
| File downloads for data analysis | Blocked; uploads still work | OpenAI help article |
The same article is plain about the limits. Lockdown Mode "does not prevent prompt injections from appearing in the content ChatGPT processes." It does not change memory, file uploads, chat sharing or model training settings. It does not affect network access in Codex. OpenAI also says it "does not guarantee data exfiltration cannot happen," and names enabled apps and "newly discovered techniques" as remaining risks. Check Point’s finding is an example of the second.
Who has it: OpenAI says eligible personal accounts and self-serve ChatGPT Business users turn it on under Settings, then Security. In managed workspaces, admins create a custom role marked as a Lockdown Mode role and assign members to it. OpenAI says Lockdown Mode does not turn off every app in a managed workspace, so admins choose which apps those members get.
What Forever Security found in Claude Dispatch
Dispatch lets you send a task from your phone to Claude Desktop on your computer. We covered it in our post on Claude computer use.
Forever Security’s write-up by Gal Weizman, dated November 4, calls the issue "ThisBash." It says the Dispatch interface could be reached from an ordinary signed-in claude.ai browser session, even though the web app showed no link to it. A browser extension that can act on claude.ai could then send instructions to Claude Desktop as if the user had typed them.
The attack needs three things, per the write-up:
- A browser extension with permission to act on claude.ai.
- The user signed in to claude.ai.
- Dispatch turned on, with a Claude Desktop app reachable on the same computer or another one.
In the demonstration, the extension clicked Claude’s approval buttons itself and had Claude install a malicious npm package. The researchers note that the Claude Desktop app can be on a different machine. A personal account in a home browser could then reach a work laptop signed in to the same account.
Forever Security says the same pattern exists in Claude Code Remote Control and Cowork sessions, and it plans a follow-up post on them.
Is Anthropic retiring Dispatch?
Anthropic has not announced it. Forever Security’s timeline says it reported the flaw on May 14. On May 19, Anthropic called the report valid but closed it as a duplicate of an issue it had already found. On October 13, according to the write-up, Anthropic said Dispatch would be retired, targeting the end of October.
The Register reported on November 5 that no bounty was paid and no CVE was issued. It says Anthropic did not answer questions about the retirement date.
Anthropic’s own pages say less. Its Dispatch help article says Dispatch "is in limited beta on some Pro, Max, and Ultra plans, and it isn’t available to new users." It gives no end date. Anthropic’s Claude release notes have no November entry about Dispatch as of November 8.
What IT should change after both findings
These steps cover both findings. The first three deal with browsers and accounts.
- Allowlist browser extensions. Google’s Chrome admin help article describes a “Block all apps, admin manages allowlist” mode in the Google Admin console. Admins can also block extensions by the permissions they request. Both findings show why an extension’s site access deserves review.
- Keep personal AI accounts off work computers. Dispatch is a personal-plan feature, so your Claude admin settings do not reach it. On Claude Enterprise, the new setting to limit Claude Desktop to allowed organizations helps. See our post on [Claude Enterprise security controls](/artificial-intelligence-ai/claude-enterprise-security-controls/).
- Ask staff who use Dispatch to turn it off. Forever Security recommends disabling cross-device dispatch where there is no business need. Anthropic’s help article already suggests cloud tasks for people who do not see Dispatch.
The next three deal with ChatGPT settings and app updates.
- Treat ChatGPT Lockdown Mode as one layer. Use it for staff who handle sensitive data, and limit the apps they can use. Do not treat it as a promise against data theft.
- Be careful with shared chats and custom GPTs. Check Point named both as delivery routes.
- Keep desktop AI apps current. Both findings involved a desktop app. Update the ChatGPT and Claude apps on a schedule, the same way you handle browsers.
The extension is the common risk. Forever Security’s attack needed only an extension with access to claude.ai. Its write-up recommends governing browser extensions as endpoint software: review permissions, control installs and watch updates that expand access.
We covered browser-level controls for AI in our post on the ChatGPT Chrome extension and in agentic browser security. Stolen browser sessions are a related problem, covered in our infostealer post.
Where Google fits
Neither finding involves Google’s Gemini. Our post on Gemini connected apps covers what a work account can reach in Gemini, which is the same question to ask of any assistant.
Frequently Asked Questions
Do I need to update anything for the ChatGPT Lockdown Mode bypass?
No. Check Point says OpenAI deployed a fix by September 18, 2026, and the technique no longer works. The fix was on OpenAI’s side.
Was the attack really zero-click?
In ChatGPT Classic, the Electron desktop app, yes, per Check Point. A conversation that loaded the malicious content was enough. Malware delivery still needed the user to click a download.
Who can turn on ChatGPT Lockdown Mode?
OpenAI says eligible personal accounts and self-serve ChatGPT Business users can turn it on in Settings, under Security. In managed workspaces, admins assign members to a Lockdown Mode role.
Does ChatGPT Lockdown Mode stop prompt injection?
No. OpenAI says it limits the outbound requests that could carry data out. A prompt injection can still change ChatGPT’s answers.
Is the Claude Dispatch flaw fixed?
Not according to Forever Security or The Register. Anthropic closed the report as a duplicate and reportedly said it would retire Dispatch instead.
Has Anthropic said Dispatch is being retired?
Not on its own site as of November 8, 2026. The retirement plan comes from Forever Security’s timeline and The Register’s report.
Can Claude Enterprise admins turn off Dispatch?
Anthropic’s help article lists Dispatch only for some Pro, Max and Ultra plans. Admins can limit Claude Desktop on managed computers to their own organization, which blocks personal accounts there.
What browser extension permissions should worry me most?
Extensions that can run scripts on every site. Forever Security’s demonstration used an extension with the scripting permission and access to all URLs, which covers claude.ai.
