OpenAI Rolls Out ChatGPT Lockdown Mode to Combat Prompt Injection and Data Leaks

Summary

OpenAI has launched a new optional security feature called “Lockdown Mode” for all ChatGPT tiers (Free, Go, Plus, Pro, and Business). The feature is designed to mitigate the risk of data exfiltration resulting from prompt injection attacks. When enabled, it limits outbound network requests and restricts several web-connected capabilities like Live Search, Deep Research, and Agent Mode, representing a major protocol shift in AI security.

What happened?

Feature Release: On June 6, 2026, OpenAI officially introduced Lockdown Mode and Elevated Risk labels to ChatGPT to address systemic security vulnerabilities.
Disabled Capabilities: To reduce the attack surface, Lockdown Mode disables Agent Mode, Deep Research, file downloads for data analysis, and loading external images. Live Web Browsing is restricted to cached content only.
Canvas Sandbox Restrictions: Any code executed within the ChatGPT workspace (Canvas) that requires network access is automatically blocked.

Why it matters

Prompt injection is a critical vulnerability where malicious instructions are hidden inside external websites, PDFs, or documents. When ChatGPT processes these sources, it can be tricked into executing the hidden instructions, potentially exfiltrating chat history or API keys to an attacker’s server. Lockdown Mode acts as a crucial “last line of defense” by cutting off the communication paths used to leak data.

Evidence

Official Documentation: OpenAI published a detailed builder guide and help center article outlining the features and limitations of Lockdown Mode.
Press Coverage: Major technology outlets like TechCrunch, ZDNet, and Engadget documented the release and analyzed the security implications for individual and enterprise users.

Analysis

Lockdown Mode is a containment strategy rather than a cure. It does not prevent prompt injections from occurring, meaning malicious inputs can still manipulate the model’s behavior or output. However, it successfully neutralizes the threat of data theft by blocking outbound connections. The trade-off is clear: users must sacrifice advanced capabilities like real-time search and autonomous agents to gain a high-security environment.

Practical Takeaways

Establish Corporate Policies: Security administrators should evaluate whether to enforce Lockdown Mode for corporate-associated ChatGPT accounts.
Evaluate User Workflows: Employees processing sensitive intellectual property or personal data should activate Lockdown Mode, acknowledging the loss of live web search.
Audit Sandbox Usage: Developers using ChatGPT for data analysis should test if their custom scripts are affected by the network block.

Open Questions

Will the lack of real-time browsing and agent functionality drive users to disable the security mode for convenience?
How quickly can OpenAI develop more granular network filters that protect data without completely disabling advanced features?