OpenAI Rolls Out Lockdown Mode to Reduce Prompt Injection Risks
OpenAI is rolling out Lockdown Mode to cut prompt-injection data theft risks for eligible ChatGPT accounts. It disables several web-connected features, but it is not a full fix.
Intelligence analysis by GPT-5.4 Mini
OpenAI has introduced an optional Lockdown Mode for users and organisations handling sensitive information. The setting reduces exposure to prompt-injection attacks by limiting web browsing, Deep Research, Agent Mode, connector actions, and other features that could help data leave the system.
It is like putting a very curious robot on a stricter leash. The robot can still help, but it cannot wander around the internet as much, which makes it harder for hidden tricks to steal secrets.
Analysis
What OpenAI changed
OpenAI has started rolling out Lockdown Mode across its products for eligible Free, Go, Plus, Pro, and self-serve ChatGPT Business accounts. The setting is optional and aimed at people and organisations that need stronger protection against data exfiltration risks tied to prompt-injection attacks.
The mode limits several web-connected capabilities. According to the article, live web browsing is reduced to cached content, Deep Research is disabled, Agent Mode is disabled, and Canvas networking cannot be approved for internet access. File downloads for analysis are blocked, though manually uploaded files still work. Live connector access and connector write actions are restricted for personal and self-serve Business accounts, and shopping and finance experiences are unavailable in the mode.
OpenAI says the feature is designed to substantially reduce the risk of prompt injection-based data exfiltration, but it does not guarantee that exfiltration cannot happen. The company also notes that risks can still come from third-party apps that remain enabled, cached data, unforeseen combinations of capabilities, or newly discovered attack methods.
Why this is being added
Prompt injection is a technique where malicious instructions are hidden inside content that an AI system reads, such as webpages, documents, emails, PDFs, or database records. If the model follows those instructions, it can ignore its original task, reveal sensitive information, or take unintended actions.
OpenAI says prompt injection is not currently a major risk, but the article notes that security researchers increasingly treat it as one of the biggest threats to AI systems. OWASP ranks it as the top security risk for LLM applications, and the UK’s National Cyber Security Centre has warned that it may never be fully eliminated because LLMs do not naturally separate instructions from data.
OpenAI frames Lockdown Mode as a way to stop the final stage of an attack by limiting outbound network requests that could leak sensitive information. It builds on existing protections like sandboxing, URL-based safeguards, monitoring, and enterprise controls.
Key points
- OpenAI is rolling out an optional Lockdown Mode for eligible ChatGPT accounts.
- The mode restricts browsing, Deep Research, Agent Mode, connectors, and some file handling.
- OpenAI says the goal is to reduce, not eliminate, prompt-injection data theft risks.
- The company says prompt injection is not a major current risk, but researchers treat it as a serious threat.
- OWASP ranks prompt injection as the top security risk for LLM applications.
If Lockdown Mode works as intended, sensitive users could use ChatGPT with less fear of hidden instructions pulling data out of the system. That could make the product more acceptable for cautious teams that need tighter controls around confidential work.
The feature is not a complete solution, and OpenAI says data exfiltration can still happen through other routes. Cached data, third-party apps, and new attack techniques could leave gaps even when Lockdown Mode is enabled.
