OpenAI introduces Lockdown Mode and Elevated Risk labels for prompt-injection defense

OpenAI rolled out Lockdown Mode on June 6, an optional ChatGPT setting that disables live browsing, agent mode, deep research, and file downloads to limit data exfiltration from prompt-injection attacks.

By Stackmaven

OpenAI introduced Lockdown Mode on June 6, 2026, an optional ChatGPT setting that disables most of the outbound network paths an attacker would use to exfiltrate data after a successful prompt injection. The feature is rolling out to personal accounts (including free-tier), self-serve ChatGPT Business, and the enterprise tier where it first shipped. The framing in OpenAI’s own announcement is unusually direct: Lockdown Mode “is designed to substantially reduce the risk of prompt injection-based data exfiltration in ChatGPT and supported OpenAI products, but it does not guarantee that data exfiltration cannot happen.” That sentence is the news. OpenAI is acknowledging at the product layer that prompt injection remains unsolved at the model layer.

What Lockdown Mode disables

Activating Lockdown Mode in Settings -> Safety and security -> Advanced security turns off the connected surfaces a prompt-injection payload needs to send data anywhere. Live web browsing is restricted to OpenAI’s cached content, removing the outbound network calls that would exfiltrate to an attacker-controlled URL. Agent Mode, Deep Research (including shopping research), Canvas networking, live connectors, file downloads, and image responses are all disabled while the setting is on. The toggle applies to the account; users can temporarily disable it for a single chat from a status message above the conversation.

For developers and security teams, the practical shift is that Lockdown Mode is the first first-party setting that meaningfully reduces what security researcher Simon Willison calls the “lethal trifecta”: a model with access to private data, exposure to untrusted content, and an outbound data channel. Lockdown Mode cuts the third leg by limiting the egress paths. The first two remain open. A malicious payload embedded in a cached page, an uploaded PDF, or any other ingested content can still influence the model’s behavior, and OpenAI is explicit that the setting does not prevent injections from entering context.

OpenAI also standardized “Elevated Risk” labels across ChatGPT, ChatGPT Atlas, and Codex, and added a session-management surface so users can review and revoke active chats. The cluster of changes reads as a defense-in-depth pass: a less risky default for sensitive use, consistent labeling so users notice when they leave that default, and a kill switch for sessions that may already be compromised.

Where this lands in the agent-security category

Prompt injection has been a known unsolved problem since GPT-3.5, and vendor responses have largely been at the model layer (training the model to ignore injected instructions, sometimes successfully) or the sandbox layer (isolating tool calls). Lockdown Mode is a different shape: a user-controlled feature flag that trades agent capability for reduced exfiltration surface. It is the closest the major chat assistants have come to a “secure mode” toggle, and it sits next to Anthropic’s recent investment in Claude Compliance APIs and Cloudflare CASB integration as parallel admissions that the agent-runtime layer is where the vulnerabilities now matter most.

The positioning is narrower than universal protection. OpenAI describes the target as “a small set of highly security-conscious users, such as executives or security teams at prominent organizations,” and explicitly notes Lockdown Mode is not necessary for most users. That framing keeps ChatGPT’s default product surface untouched while giving regulated buyers a reason to clear procurement.

For agent-building developers, the implication is that any product integration with ChatGPT can no longer assume Agent Mode, Deep Research, or live connectors are reliably available. Users with sensitive workloads may have those features off. Integrations should fall back gracefully and surface degraded states rather than failing silently.

What’s worth watching

Whether Anthropic, Google, and the other agent platforms ship equivalent toggles. Claude already exposes per-tool permission controls, but a single “lockdown” setting is a more legible product pattern. If Gemini, Claude, and the third-party agent runtimes (LangChain, AutoGPT, Cursor) ship analogues within the quarter, it is the start of a category.
Adoption among enterprise buyers. OpenAI is positioning Lockdown Mode as a procurement-clearing feature for regulated organizations. Whether it actually moves the needle on Fortune 500 ChatGPT Business renewals is the test: a security toggle that no buyer turns on is a marketing artifact, not a control.
Whether the cached-browsing limitation creates new attack surface. Restricting browsing to OpenAI’s cached content removes one egress path but creates a single dependency on whatever caching pipeline OpenAI runs. A poisoned cache (intentionally or via the long-tail of indexed sites) would land in a context where the user has explicitly opted into reduced agency.

The longer arc is that “secure-by-default” agent products are not shipping yet, but “secure-on-request” is. The next 18 months of enterprise procurement will tell whether that is enough.

Stackmaven’s follow-up on Lockdown Mode adoption lands on or around September 5, 2026.

Sources cited