OpenAI adds ChatGPT Lockdown Mode to reduce prompt-injection data theft risk

OpenAI has introduced a new ChatGPT Lockdown Mode designed to reduce the risk that prompt-injection attacks can extract sensitive user data.

What Lockdown Mode changes

According to OpenAI’s ChatGPT release notes, Lockdown Mode is available to all logged-in users and restricts features that connect ChatGPT to the web or external services. OpenAI says the mode limits live web browsing, deep research, agent mode, file downloads, and some image support that depends on web-derived content.

A separate OpenAI Help Center page on Lockdown Mode says the setting also limits Canvas networking and other external-service access. OpenAI frames the feature as a safeguard for people working with sensitive data, where a malicious instruction hidden in a webpage, document, or other external source could try to make the model reveal private information.

The Decoder and TechCrunch both reported that the feature is intended to make data theft through prompt injection harder by cutting off common channels used to retrieve instructions from the web or send information back out.

Why prompt injection matters

Prompt injection is a security issue in which a model follows malicious or unintended instructions embedded in content it is asked to process. In practical terms, a user might ask ChatGPT to summarize a webpage, email, document, or other external material. If that material contains hidden instructions telling the model to ignore prior directions or disclose sensitive context, the model may be manipulated into taking unsafe actions.

The risk becomes more serious when an AI system has access to external tools. If a chatbot can browse the web, download files, call external services, or operate in a more autonomous mode, an attacker may try to build a chain that first manipulates the model and then uses a connected capability to move data outside the user’s session.

OpenAI’s Lockdown Mode appears to focus on that second part of the chain. By disabling or restricting browsing, deep research, agent mode, downloads, Canvas networking, and related web-connected features, the setting reduces the number of paths through which sensitive data could be exfiltrated.

A reduction in risk, not a complete fix

OpenAI’s help materials describe Lockdown Mode as a way to reduce prompt-injection data-exfiltration risk, not as a complete defense. TechCrunch similarly noted that the feature reduces but does not eliminate prompt-injection risk. The Decoder also reported that the mode does not fully prevent such attacks and instead blocks the final step in a possible exfiltration chain.

That distinction matters. A model may still encounter malicious instructions in user-provided or external content, and it may still be influenced by them. Lockdown Mode limits what the model can do with certain outside connections, but it does not solve the broader problem of reliably distinguishing legitimate user intent from hostile instructions embedded in data.

Security researchers and AI companies have repeatedly treated prompt injection as a difficult open problem because large language models process instructions and data through the same natural-language interface. When an untrusted document says “ignore previous instructions,” the system must determine that the text is content to analyze, not an instruction to obey. That boundary remains challenging.

Who should consider using it

Based on OpenAI’s description, Lockdown Mode is most relevant for users handling confidential business information, legal or medical material, private research, personal records, or other sensitive data in ChatGPT. The setting may be especially useful when the task does not require live web access, external research, file downloads, or autonomous tool use.

The trade-off is reduced functionality. Users who enable the setting should expect some ChatGPT features to be unavailable or limited. OpenAI’s release notes and Lockdown Mode support page indicate that the affected areas include live browsing, deep research, agent mode, Canvas networking, file downloads, and certain web-based image capabilities.

The bigger picture

Lockdown Mode is a defensive control rather than a cure for prompt injection. It gives ChatGPT users a way to narrow the system’s external connections when working with sensitive information, which can reduce opportunities for data exfiltration. But OpenAI’s own support language, along with reporting from The Decoder and TechCrunch, makes clear that the feature should be understood as risk reduction, not a guarantee.

For users and organizations adopting AI tools, the practical lesson is straightforward: disable unnecessary external capabilities when working with sensitive data, treat untrusted content as potentially hostile, and avoid assuming that an AI assistant can always separate instructions from data safely.