OpenAI Ships ChatGPT 'Lockdown Mode' to Blunt Prompt-Injection Data Theft

OpenAI has started rolling out a Lockdown Mode for ChatGPT, an opt-in setting aimed at users whose accounts handle sensitive data and who want narrower attack surface against prompt-injection exfiltration.

The feature is live for logged-in personal accounts across Free, Go, Plus and Pro tiers.

Prompt injection remains the dominant unsolved problem in production LLM deployments. An attacker hides instructions inside a webpage, a document, an email or a calendar invite. The model ingests them. If the assistant has tools wired up — browsing, connectors to Gmail or Drive, memory, image rendering — those instructions can quietly tell it to package up whatever it can read and ship it to an attacker-controlled endpoint.

Lockdown Mode's answer is to take the tools away.

When enabled, the setting disables third-party connectors, restricts browsing behaviour, blocks image generation, and prevents the assistant from writing to long-term memory. Custom GPTs are also off-limits in the locked-down session. The trade-off is obvious: a stripped-down ChatGPT that can't reach into your inbox is also a ChatGPT that can't be tricked into mailing your inbox to someone else.

The rollout follows a year of public proofs-of-concept against agentic AI systems. Researchers including Johann Rehberger have repeatedly demonstrated indirect prompt-injection chains that abuse connectors and rendered markdown images to leak chat content or stored memories. Several of those issues were patched piecemeal. Lockdown Mode is the first vendor-level kill switch that turns off the categories of capability injection abuses rely on, rather than playing whack-a-mole with individual payloads.

It is not a default. Users have to flip it on, which limits its impact to people already worried enough to look for it. Enterprise and Team accounts, where the data-exfiltration risk is arguably highest, are not the initial target of this consumer-facing toggle.

There's also a question of how Lockdown Mode interacts with ChatGPT's agentic features, which OpenAI has been pushing hard. An agent that cannot browse, cannot use connectors and cannot render images is not much of an agent. Customers will end up choosing between capability and containment per session, which is probably the honest framing anyway.

For security teams, the practical guidance is narrow but real. If staff use personal ChatGPT accounts to process anything sensitive — contracts, source code, incident notes — Lockdown Mode is now the recommended posture, and it should be documented in acceptable-use policy. For the broader ecosystem, it sets a marker. Anthropic, Google and Microsoft all ship assistants with similar tool-calling surfaces and similar injection exposure. Expect comparable toggles to appear.

OpenAI has not published a formal security advisory tied to the launch. Documentation is being surfaced inside the product settings panel as the feature reaches each account.