OpenAI's ChatGPT has introduced Lockdown Mode, an advanced security setting aimed at protecting sensitive user data from prompt injection-based exfiltration attacks. However, Check Point Research has discovered a vulnerability that can bypass these protections, rendering them ineffective.
The vulnerability exposes a wide attack surface, enabling silent exfiltration of entire chat history, credential theft via phishing, and malware delivery. In ChatGPT Classic, attackers can exploit this vulnerability without any user interaction, simply by having a conversation.
The vulnerability allows for manipulation of the ChatGPT Classic interface, including displaying popup windows with arbitrary content, which opens the door to a wide range of phishing attacks. Potential attack scenarios include embedding external images or links that could trigger zero-click exfiltration of private data.
The vulnerability can be exploited through a malicious prompt, a malicious GPT, or a shared chat. The rendered HTML is placed inside a sandbox, which separates user-controlled content from the main ChatGPT application context. However, the sandbox does not explicitly restrict popups, allowing attackers to potentially open a popup window and execute arbitrary HTML code.