OpenAI rolls out Lockdown Mode to stop prompt injections

As AI gets better at browsing the web and running autonomous tasks, hackers have found a sneaky way in: prompt injection. Hide a few malicious instructions on a webpage, and an unsuspecting AI bot might happily exfiltrate your private data.

OpenAI's latest countermeasure is Lockdown Mode, an optional extreme security setting designed as a last line of defense for users handling highly sensitive information.

Crippling features to lock down data

Lockdown Mode does not claim to make ChatGPT immune to trickery. Instead, it assumes prompt injections might still happen—even inside cached pages or uploaded files—and cuts off the network routes an attacker would use to smuggle data out.

Flip the switch, and ChatGPT gets severely restricted. Live web browsing is downgraded to cached content only. The system can no longer pull or display external images, and it is blocked from downloading files across the internet. Powerhouse features like Deep Research and Agent Mode are turned off completely.

You can still generate fresh images and manually upload files for analysis. However, OpenAI clarifies that Lockdown Mode will not touch your memory settings, sharing permissions, or whether your chats train future models.

The feature is available now for eligible personal accounts, including free-tier users, as well as self-serve ChatGPT Business workspaces. You can toggle it under Safety and security in Settings, or temporarily pause it for a single chat.

Alongside this, OpenAI introduced an active session manager. Users can now audit every active device and browser logged into their account, with options to kill individual sessions or log out everywhere, though mass logouts may take up to 30 minutes.

Why it matters

We see Lockdown Mode as a candid admission from OpenAI: prompt injection is still fundamentally unsolved, and backend guardrails alone cannot guarantee data safety.

Taking a page from Apple's Lockdown Mode playbook, OpenAI is trading capability for survival. For the average user looking up recipes or drafting emails, this feature is useless and will only feel broken. But for lawyers, financial analysts, and corporate researchers who frequently drop proprietary documents into the chat window, the ability to seal the sandbox is genuinely valuable.

Across the industry, labs have spent the past year racing to hand agents unrestricted access to the live web. OpenAI is sending a sobering reminder that every new integration creates an exfiltration vector. Going forward, enterprise adoption might depend just as much on how cleanly an AI can cut its own wire.