Lockdown Mode Changes the Face of ChatGPT: More Privacy, Less Operational Freedom
OpenAI has announced the release of Lockdown Mode, a new advanced security setting for ChatGPT designed to reduce the risk of sensitive data exfiltration through prompt injection attacks. The feature is currently being rolled out for eligible personal accounts— including Free, Go, Plus, and Pro plans— as well as for self-service managed ChatGPT Business accounts.
Prompt injections represent one of the main security challenges in the realm of language models. These are malicious instructions hidden within web pages, documents, or other content sources that can influence the behavior of artificial intelligence, causing it, in some cases, to disclose sensitive information or perform unintended operations.
According to OpenAI, Lockdown Mode does not eliminate the possibility of a prompt injection being processed by the model, but rather aims to disrupt the final phase of the attack: the transfer of data to external systems controlled by a potential attacker. To achieve this goal, the mode significantly limits all features that involve outgoing network requests or interactions with external services.
Among the introduced restrictions is the disabling of real-time web browsing, replaced by exclusive access to cached content. This means that search results may be incomplete, unavailable, or outdated. The retrieval and display of images from the web is also blocked, although image generation and the ability to upload graphic files manually remain available.
The mode also disables Deep Research and Agent Mode, two of the most advanced features of ChatGPT that allow for extended research tasks and multi-step automated operations, respectively. Additional limitations affect Canvas, which can no longer run code with network access without user authorization, and file downloads for data analysis activities. However, it remains possible to work on manually uploaded documents.
OpenAI emphasizes that Lockdown Mode does not change other aspects of the platform, such as conversation memory, the ability to share chats, file uploads, or settings related to using content for model improvement. Network access via Codex is also not affected by the new mode.
Regarding apps, connectors, and external integrations, behavior varies based on the account type. In personal and self-service Business accounts, connectors based on already synchronized data continue to work, while real-time access and write operations are blocked. Some integrated experiences, like financial services available in ChatGPT or automated shopping tools, are not usable when Lockdown Mode is active.
In centrally managed business environments, the situation is more complex. Administrators can create specific roles associated with Lockdown Mode and control in detail which applications, connectors, or actions are allowed for users. OpenAI recommends enabling only tools considered reliable and carefully assessing the risks associated with operations that produce visible effects externally, deemed more exposed to potential exfiltration attempts.
The company also highlights that Lockdown Mode and Developer Mode cannot be used simultaneously: activating one automatically deactivates the other.
While presenting the new feature as an additional layer of defense within a system that already includes sandboxing, URL checks, activity monitoring, and auditing tools for businesses, OpenAI acknowledges that the risk cannot be completely eliminated. A prompt injection could indeed be present in already cached content or within files uploaded by the user, continuing to influence the quality or correctness of the generated responses.
The company further specifies that prompt injection is not currently a widespread threat for most users, but believes that its relevance may increase with the evolution of attack techniques. For this reason, Lockdown Mode is proposed mainly as an option for professionals, organizations, and entities that deal with particularly sensitive information and are willing to forfeit some advanced functionalities in exchange for greater security guarantees.