ChatGPT Lockdown Mode: The Setting OpenAI Built to Starve Prompt Injection

On 13 February 2026 OpenAI announced Lockdown Mode, an optional ChatGPT setting that constrains what the assistant can send out to the network, so a prompt-injection attack has no route to carry stolen data out. Browsing drops to cached content, no live request leaves OpenAI's controlled network, and any feature that cannot be given a deterministic guarantee of safety is shut off rather than filtered. It shipped first to ChatGPT Enterprise, ChatGPT Edu, ChatGPT for Healthcare and ChatGPT for Teachers, switched on by workspace admins, with consumers promised access "in the coming months" — a promise the same OpenAI page records as kept on 4 June 2026. No breach, victim or data loss is attached: the AI Incident Archive files this as an information-severity policy record with confidence grade A. The record's citation list and the governance entries filed either side of it are held in the Orca AI Incident Archive, which also links the primary OpenAI announcement.

What Lockdown Mode switches off

OpenAI frames Lockdown Mode as a setting for "a small set of highly security-conscious users — such as executives or security teams at prominent organizations — who require increased protection against advanced threats", and states plainly that it "is not necessary for most users." What it does is subtract capability. The list below is OpenAI's own, taken from the announcement and from the Lockdown Mode help-centre article that announcement links to.

• Live web browsing. Browsing is limited to cached content, so no live network requests leave OpenAI's controlled network. Search results "may be limited, unavailable, or stale."

• Image support. ChatGPT may not display images in regular responses or retrieve images from the web. Uploading image files still works, and image generation remains available where it otherwise would be.

• Deep Research. Disabled. OpenAI's 4 June update specifies that this includes shopping research.

• Agent Mode. Disabled.

• Canvas networking. Users cannot approve Canvas-generated code to reach the network.

• File downloads. ChatGPT cannot download files for data analysis. It can still work on files the user uploads by hand.

• Live connectors and app write actions. On personal and self-serve Business accounts, the help-centre article says live access to external services and app write actions are blocked where they conflict with the mode's protections, and that "Finances in ChatGPT and shopping-agent experiences" are unavailable.

Three things Lockdown Mode explicitly does not touch: memory, file uploads, and whether a conversation may be used to improve models. It also does not affect network access in Codex, OpenAI's coding assistant — a point worth holding on to, because Codex is one of the products that carries the second half of this announcement.

The attack it is designed to starve

Prompt injection is the attack class. A third party hides instructions in content the model will read — a web page, a PDF, a shared document — and the model treats those instructions as legitimate, acting on them or disclosing what is in the conversation. OpenAI's own description of the risk is that an adversary "attempts to mislead a conversational AI system into following malicious instructions or revealing sensitive information." In a connected assistant the payload does not need to be clever; it needs an outbound path. A crafted link such as attacker.example/collect?data= followed by private data is enough, because the data lands in the attacker's server logs and nothing suspicious appears in the chat.

Most defences try to stop the model from obeying. Lockdown Mode does not. It removes the outbound paths instead, which is why OpenAI keeps using the word "deterministic": the restriction is enforced by the product's plumbing, not by the model's judgement, so a payload that wins the argument still has nowhere to send the winnings. In the announcement's own words, Lockdown Mode "deterministically disables certain tools and capabilities in ChatGPT that an adversary could attempt to exploit to exfiltrate sensitive data."

What OpenAI does not claim

The limits are stated by OpenAI rather than extracted from it, and they matter more than the feature list. The help-centre article says Lockdown Mode "does not prevent prompt injections from appearing in the content ChatGPT processes", and gives the example directly: an injection in cached web content or in an uploaded file "could still affect the behavior or accuracy of a response." The injection still lands. Only the exit is closed.

Asked about guarantees, OpenAI told the trade press what it does not promise. "Lockdown Mode is designed to substantially reduce the risk of prompt injection-based data exfiltration, but it does not guarantee that data exfiltration cannot happen," the company said, adding that "risk may remain through enabled Apps, unforeseen combinations of capabilities, or newly discovered techniques" (as quoted by The Next Web, 7 June 2026). Apps are the conspicuous hole: in managed workspaces, Lockdown Mode "does not automatically disable every app", and the help centre advises admins that read or write actions for untrusted apps are "not recommended", and that write actions should be avoided even for trusted apps whose side effects cannot be confirmed hidden from a malicious actor.

The "Elevated Risk" label, and what it is not

The second half of the 13 February announcement is a labelling change rather than a control. OpenAI standardised the wording on a "short list" of existing capabilities that carry unresolved network risk, so that the same "Elevated Risk" label appears across ChatGPT, ChatGPT Atlas and Codex — the company's argument being that users should get identical guidance wherever they meet the same capability. The worked example is Codex: a developer granting the coding assistant network access to look up documentation now sees the label on the settings screen, next to the domain allowlist and the permitted HTTP methods, with an explanation of what changes and when the access is appropriate.

The label is a warning, not a lock. The capability still runs once the user accepts it. OpenAI also set its own expiry condition: it "will remove the 'Elevated Risk' label once we determine that security advances have sufficiently mitigated those risks for general use", and will keep changing which features carry it. That is an unusually explicit admission that the list is a snapshot of what the company currently considers unsafe by default.

From an enterprise role to a Settings toggle

The February release was enterprise-only, and it was administered rather than user-chosen. Admins on ChatGPT Enterprise, Edu, for Healthcare and for Teachers enabled it in Workspace Settings by creating a new role, which layered the extra restrictions on top of whatever the workspace already enforced. Admins kept granular control, choosing exactly which apps and which specific actions inside those apps stayed available — a concession OpenAI explained by noting that "some critical workflows rely on apps." Separately from the mode, the Compliance API Logs Platform gives administrators visibility into app usage, shared data and connected sources.

The consumer promise was kept on 4 June 2026, when OpenAI added an update note to the top of the same announcement page: Lockdown Mode was rolling out "to personal ChatGPT accounts as well as self-serve ChatGPT Business accounts", available from Settings, with the restriction list restated to include live web access, image support in responses, Deep Research including shopping research, Agent Mode, Canvas networking, live connectors and file downloads. PCMag reported the rollout on 6 June 2026 and The Next Web on 7 June 2026; The Cyber Express, which had covered the February announcement on 18 February, noted in its June follow-up that the setting had reached Free, Go, Plus and Pro accounts. The Next Web's account adds two operational details not in OpenAI's post: Lockdown Mode and Developer Mode cannot be enabled at the same time, and OpenAI shipped a separate session-management feature alongside it, letting users review active sessions and sign out individual devices.

What is established here, and what is not

Everything above about how the mode behaves is OpenAI's own account, restated by outlets that were working from the same post. The February coverage — eWeek on 17 February 2026, The Cyber Express on 18 February 2026, and a cluster of regional technology desks including ZDNet Japan and Techlusive — describes the feature accurately but adds no independent testing: none of the coverage read for this piece reports having tried to defeat Lockdown Mode, and the announcement itself cites no external security evaluation. That is a limit on what the record can tell you. The archive's confidence grade of A describes how well documented the event is and how far its primary sources agree, not how well the control works.

The record also carries no real harm. This is a policy entry, not an incident: no organisation is named as a victim, no exfiltration is counted, and nothing here establishes that a specific attack prompted the release. OpenAI presents Lockdown Mode as an addition to existing protections — sandboxing, URL-based data-exfiltration defences, monitoring and enforcement, role-based access and audit logs — rather than as a response to a disclosed breach.

There is a live argument about what the feature means, and it should be labelled as argument. The Cyber Express, in a June analysis piece, put the question as whether Lockdown Mode's existence concedes that ChatGPT at its defaults "does not provide robust protection against sufficiently determined data exfiltration attacks", and answered that OpenAI "does not seem to dispute this" — reading the mode as "a last-line-of-defense control" rather than an anti-injection one. That is a columnist's interpretation, and OpenAI's own text supports the factual half of it while making no such admission. The archive does not mark this record as disputed, and on the facts it is not: the disagreement is over framing, not over what the setting does.

What a reader can check without trusting anyone is small but real. The setting either appears in an account's security controls or it does not, and the restriction list either matches OpenAI's description or it does not. The parts that cannot be checked from outside are the ones that matter most: whether the deterministic restrictions hold against an adversary who is actually trying, and whether the apps and actions an administrator leaves enabled reopen the path the mode was built to close. OpenAI's own caveat — risk may remain through enabled apps, unforeseen combinations of capabilities, or newly discovered techniques — is the honest summary of where that stands.