- OpenAI’s Lockdown Mode is a new ChatGPT security feature designed to reduce prompt injection and data exfiltration risks for sensitive users.
- Lockdown Mode disables live web browsing, image retrieval, deep research, and agent mode — trading flexibility for a tighter security posture.
- OpenAI openly admits the feature isn’t a complete fix, as prompt injections can still appear in cached content and uploaded files.
- The rollout currently targets self-serve ChatGPT Business accounts and eligible personal accounts handling sensitive data.
- OpenAI’s Lockdown Mode is a new ChatGPT security feature designed to reduce prompt injection and data exfiltration risks for sensitive users.
- Lockdown Mode disables live web browsing, image retrieval, deep research, and agent mode — trading flexibility for a tighter security posture.
- OpenAI openly admits the feature isn’t a complete fix, as prompt injections can still appear in cached content and uploaded files.
- The rollout currently targets self-serve ChatGPT Business accounts and eligible personal accounts handling sensitive data.
Table of Contents
Lockdown Mode Is OpenAI’s Answer to a Growing Security Problem
OpenAI has introduced Lockdown Mode for ChatGPT, a feature specifically built to reduce the risk of prompt injection attacks — a category of threat that’s been quietly unnerving security professionals for years. The idea is straightforward: when you’re dealing with sensitive data, you want the AI to be less adventurous about where it goes and what it reads. Lockdown Mode pulls ChatGPT back from its most connected, agentic behaviours and keeps it on a shorter leash.
Prompt injection attacks work by hiding malicious instructions inside content the AI encounters — a webpage, a document, even an image. When ChatGPT processes that content, the hidden commands can manipulate what the model does next. The results can range from mildly annoying (a skewed response) to genuinely dangerous: leaking confidential business data, executing unintended actions in agent workflows, or quietly redirecting an AI assistant to serve an attacker’s goals instead of the user’s. As AI tools become deeper fixtures in professional workflows, the prompt injection surface area has grown considerably.
What Lockdown Mode Actually Turns Off
Enabling Lockdown Mode isn’t a minor tweak — it meaningfully cuts back on what ChatGPT can do. Live web browsing gets disabled entirely, so the model can only work with cached content rather than fetching fresh pages in real time. The retrieval and display of images from the web is also switched off, though image generation remains available. Deep research — one of ChatGPT’s more impressive recent capabilities — is turned off, as is agent mode, which allows ChatGPT to take autonomous actions across tools and services.
That’s a fairly substantial list. Agent mode in particular is one of the features OpenAI has been pushing hard as a differentiator for its business offering, so disabling it by default in Lockdown Mode is a real concession. It signals that OpenAI is taking the security concerns seriously enough to temporarily sideline one of its flagship capabilities for users who need the added protection. The trade-off is clear: you get a tighter security posture in exchange for a less capable assistant.
It’s also worth understanding why each of these features gets cut. Live browsing and web image retrieval are obvious vectors — they pull in external content that could contain injected instructions. Deep research, which involves the model autonomously searching and synthesising large volumes of information, creates a massive attack surface with little user visibility into what it’s reading. And agent mode, almost by definition, takes actions based on what the model encounters, making it particularly dangerous if that content has been tampered with.
OpenAI Admits Lockdown Mode Isn’t a Silver Bullet
Here’s where OpenAI deserves some credit for candour: the company hasn’t oversold what Lockdown Mode can do. In its own documentation, OpenAI acknowledges that even with the feature switched on, ChatGPT “could still be vulnerable to prompt injections.” Specifically, injections can “appear in cached web content or in an uploaded file, and could still affect the behavior or accuracy of a response.”
Source: TechCrunch
