OpenAI's Lockdown Mode Admits the Problem It Can't Quite Fix

Key points

• Lockdown Mode restricts several ChatGPT capabilities but manually uploaded files still move through it freely.
• OpenAI's own FAQ says prompt injection is not currently a major risk, a claim analysts found hard to square with building a containment feature.
• Prompt injection (hiding malicious instructions inside content the model reads) lets data leave through paths Lockdown Mode does not close.
• Analysts disagree on whether enterprises or vendors should own this problem, though Gartner's Dennis Xu says only OpenAI can govern OpenAI's outbound traffic.
• A patchwork of vendor-specific controls is the likely near-term reality until cross-vendor governance tools mature.

OpenAI quietly built a panic room. Lockdown Mode, now available in enterprise product settings, restricts web browsing to cached content, disables Deep Research and Agent Mode, blocks Canvas-generated code from reaching the network, and prevents ChatGPT from pulling down files for analysis. Manually uploaded files still flow through. The company announced the feature in a blog post without responding to follow-up questions. When we first reported the feature on 6 June, the picture was already incomplete: the opt-in setting strips connectors and browsing tools, but the governance question was unresolved.

Does OpenAI believe its own reassurances?

The feature's FAQ is instructive. OpenAI asked itself whether prompt injection is a major risk and answered: not currently, though impact could grow as attackers develop more sophisticated methods. Consultants noticed the tension immediately.

"A vendor does not build a panic room for a house it believes is safe," said Sanchit Vir Gogia, chief analyst at Greyhound Research. "Lockdown Mode is the admission itself."

The mode is porous by design. Gogia described the residual exposure bluntly: a model can carry a trusted user's authority while acting on instructions hidden inside untrusted content, letting data leave by a side door. Tom Findling, CEO of Conifers.ai, was candid about the ceiling. "Is it Nirvana? Probably not, but this is likely the best they could have done, given the infrastructure they have today." An unnamed executive at a major agentic cybersecurity firm added: "Almost every sandboxing solution out there, AI has been able to break out of."

Should you worry?

The human factor adds a layer no mode can address. An agent told to pull quarterly revenue figures from internal finance documents and share them with the requesting employee has no way to know that selective pre-announcement disclosure may violate SEC rules. The model supplies the data. Whoever asked commits the violation. Lockdown Mode is irrelevant to that sequence.

Analysts split on the governance question. Erik Avakian of Info-Tech Research Group argued enterprises already have the tools: network segmentation, least privilege, Zero Trust (the principle that no user or device is trusted by default) and application controls. Dennis Xu, research VP at Gartner, pushed back directly. "ChatGPT is a web/SaaS based application that cannot be air gapped. In the shared responsibility model, this falls under provider responsibility." His conclusion: enterprises wanting this control from other AI vendors need to file feature requests, because OpenAI can only govern OpenAI.

Flavio Villanustre, CISO at LexisNexis Risk Solutions Group, warned the outcome is a "patchwork of controls" across vendors until independent third-party governance tools mature. Gogia agreed: each vendor's lockdown constrains only its own product, leaving local models or assistants embedded in third-party workflows entirely outside OpenAI's perimeter.

Lockdown Mode is an incremental improvement. It is not an architecture.

What enterprise teams should do now: Audit which AI products your organization uses and which sit outside any vendor-provided lockdown controls. Apply network egress restrictions at the infrastructure layer where possible. Document data-classification rules explicitly in AI usage policies and treat vendor-supplied containment features as one control in a layered stack, not a substitute for the stack itself.