OpenAI Launches Lockdown Mode to Block Prompt Injection Attacks

Key Takeaways

• Lockdown Mode restricts ChatGPT to cached content only, disabling live web browsing, Deep Research, and Agent Mode
• The feature addresses prompt injection attacks where hidden instructions in websites or documents trick AI into revealing sensitive data
• OpenAI explicitly states this is a tradeoff: users gain security but lose image generation, shopping features, and live search capabilities

OpenAI has rolled out Lockdown Mode for ChatGPT, a security feature that cuts off the AI's access to the live web and external services. The goal: stop prompt injection attacks before they can steal user data.

The feature is now available to ChatGPT Free, Go, Plus, Pro, and self-serve Business accounts. But OpenAI is clear about who should use it. "Lockdown Mode is not intended for everyone," the company wrote on its support page. "It is designed for people and organisations that handle sensitive data and want stricter protection from data exfiltration risks related to prompt injection."

What Prompt Injection Actually Does

Prompt injection is a growing threat for large language models. Attackers embed hidden instructions in websites, emails, images, or documents. When ChatGPT processes this content, those instructions can trick the AI into revealing sensitive information about the user or their organization.

Security researcher Simon Willison calls this the "Lethal Trifecta": private data access, untrusted content, and an exfiltration vector. When all three exist, attackers have a path from your sensitive data to their servers.

“Lockdown Mode directly attacks the 'Lethal Trifecta'—the combination of private data access, untrusted content, and an exfiltration vector. It's the first major admission that we can't 'prompt engineer' our way out of structural risk.”

— Simon Willison, Security Researcher

The numbers back up the concern. In red-team testing during 2026, 84% of agentic AI systems failed prompt injection tests. Among enterprise AI users, only 34.7% have documented prompt injection defenses in place.

What Lockdown Mode Disables

Lockdown Mode takes a brute-force approach to security. It disables the features that could serve as exfiltration vectors. Here's what gets cut:

• Live web browsing is restricted to cached content only
• Deep Research and Agent Mode are completely disabled
• Canvas-generated code can no longer access the internet
• Image display and image generation are turned off
• Shopping-agent features are blocked
• The Finances connector is disabled

OpenAI's support documentation is blunt about the tradeoff: "Prompt injection in AI browsers may never be fully patched. Defense requires architectural tradeoffs that reduce AI functionality."

What Still Works

Some core features remain intact. Memory stays on. File uploads work. You can still share conversations. And your chats may still be used to improve OpenAI's models, unless you've opted out separately.

This matters for enterprise users. You can still upload documents for analysis, maintain context across sessions, and collaborate with colleagues. The restriction targets network requests, not local processing.

Why This Matters for Enterprise Users

The feature addresses a specific pain point for organizations handling sensitive data. Law firms reviewing M&A documents, healthcare providers discussing patient cases, and financial institutions analyzing proprietary data all face the same risk: an employee pastes sensitive content into ChatGPT, ChatGPT browses a malicious site, and data leaks.

Lockdown Mode shifts ChatGPT from "probabilistic" defense, where the AI tries to spot malicious intent, to "deterministic" defense, where the risky features simply don't exist. No network request means no exfiltration path.

The Limits of Lockdown Mode

OpenAI is upfront about what this feature cannot do. Lockdown Mode "does not prevent prompt injections from appearing in content processed by ChatGPT." A malicious instruction in a document you upload could still affect the accuracy of responses.

The protection is specific: it blocks the final stage of an attack, where data gets sent out. The AI can still be confused or manipulated. It just can't phone home to an attacker's server.

Community Response: Useful or Crippling?

User reactions split along predictable lines. On Reddit's r/ChatGPT, power users call the locked-down feature set "lobotomized." Business users handling sensitive M&A or health data see it as a necessary compromise.

The Hacker News debate focuses on legal liability. By making Lockdown Mode opt-in rather than default, OpenAI may be attempting to shift responsibility to users who don't enable it. If you get hit by a prompt injection attack, did you fail to take reasonable precautions by leaving Lockdown Mode off?

How to Enable Lockdown Mode

Once the feature reaches your account, you can enable it through ChatGPT's settings. OpenAI is rolling it out to all tiers: Free, Go, Plus, Pro, and self-serve Business accounts.

The practical question for organizations: which employees need it? Anyone handling sensitive client data, proprietary research, or personal health information is a candidate. Employees using ChatGPT for general research or content creation may not need the restrictions.

Frequently Asked Questions

Does Lockdown Mode prevent all prompt injection attacks?

No. It blocks the final stage, data exfiltration, but malicious instructions in processed content can still affect response accuracy.

Which ChatGPT plans support Lockdown Mode?

All tiers: Free, Go, Plus, Pro, and self-serve Business accounts. OpenAI is rolling it out to all users.

Can I still upload files with Lockdown Mode enabled?

Yes. File uploads, memory, and conversation sharing all remain functional. The restrictions target network requests, not local processing.

Will Lockdown Mode affect ChatGPT's memory of my preferences?

No. OpenAI confirms that memory, conversation sharing, and model training settings are unaffected by Lockdown Mode.

Is Lockdown Mode on by default?

No. It's opt-in. Users must manually enable it through ChatGPT settings once it's available on their account.

Source: mint / Aman Gupta