OpenAI brings Lockdown Mode to personal ChatGPT accounts

Apple famously introduced Lockdown Mode to protect high-profile targets from extreme cyber threats by gutting non-essential features. Now, OpenAI is taking a page straight from Cupertino’s playbook.

OpenAI has introduced Lockdown Mode and new Elevated Risk labels across its ecosystem. Initially launched for enterprise, education, and healthcare tiers, the defensive setting has expanded to personal ChatGPT accounts and self-serve business plans. It is designed for moments when keeping private data locked down matters far more than having access to cutting-edge web features.

Pulling the plug on the live web

As AI models gain real-time web access and agency, prompt injection has become an industry-wide headache. Attackers can plant malicious hidden instructions across external web pages or third-party tools, tricking an AI into exfiltrating your conversation logs or confidential files.

Lockdown Mode fights back by deterministically cutting off potential leaks. When you toggle it on, live web browsing is replaced strictly by cached content, meaning zero live network requests leave OpenAI's controlled perimeter.

Several popular features get turned off entirely. Responses drop image support, while Deep Research, shopping research, Agent Mode, Canvas networking, live connectors, and direct file downloads are all disabled. For enterprise workspaces, admins can assign the mode by role and selectively whitelist specific apps and actions, backed by compliance audit logs.

Along with Lockdown Mode, OpenAI standardized an Elevated Risk warning badge across ChatGPT, ChatGPT Atlas, and Codex. Whenever a tool introduces extra exposure—like letting Codex search the web for external documentation—users now get an upfront warning explaining the specific danger.

Why it matters

We think this is a major reality check for the entire AI agent space. Everyone wants to sell autonomous agents that can browse the web and click around your tools, but prompt injection remains fundamentally unsolved at the architecture level. By launching Lockdown Mode, OpenAI is essentially admitting that bulletproof sandboxing doesn't exist yet for live web actions.

For everyday users asking recipe tips or rewriting casual emails, turning this on makes zero sense—you lose too much functionality. But for executives, legal teams, and security researchers handling merger documents or private credentials, trading flashy features for peace of mind is an easy call.

OpenAI is being smart by being honest about risk instead of pretending guardrails are impenetrable. Giving users granular controls and clear warning labels might feel like a step backward in convenience, but in the enterprise world, predictable isolation will always beat unvetted magic.