← Back to feed

OpenAI first announced Lockdown Mode on February 13 for enterprise, education, healthcare, and teacher plans. On June 4, the company expanded it to all personal ChatGPT accounts and self-serve Business subscribers. Any user can now enable it from Settings > Security > Advanced Security.

The timing is not coincidental. The Meta Instagram AI chatbot incident — in which hackers exploited Meta’s AI support assistant to take over accounts by simply asking it to reroute email ownership — ran publicly for at least a week before Meta patched it. It demonstrated, at scale, what happens when AI systems with elevated account permissions have no deterministic guardrails on sensitive actions.

Lockdown Mode is OpenAI’s architectural answer to the same class of risk applied to ChatGPT.

What It Disables

When Lockdown Mode is on, ChatGPT turns off or restricts the following:

• Live web browsing: Limited to cached content only. No live network requests leave OpenAI’s controlled network. This cuts off the primary exfiltration path where a prompt injection in a webpage triggers ChatGPT to send sensitive conversation data to an attacker-controlled endpoint.
• Image display from web: Image generation still works. Retrieving images from the live web does not.
• Deep Research: Fully disabled.
• Agent Mode: Fully disabled.
• Canvas networking: Disabled.
• Live connectors: Disabled.
• File downloads: Disabled. Manual file uploads remain available.

What Lockdown Mode does not change: memory, conversation sharing, file uploads, and whether conversations may be used for model improvement. Those remain separately configurable.

What It Does Not Prevent

OpenAI is explicit that Lockdown Mode is not a complete defense. Prompt injections can still appear in cached web content or in uploaded files, and could still affect response behavior or accuracy. The mode’s goal is narrower: prevent a successful injection from triggering an outbound network request that exfiltrates data to a third party.

The threat model Lockdown Mode is built for: an attacker embeds malicious instructions in a document or webpage, ChatGPT processes the content, and the injected instructions direct ChatGPT to exfiltrate sensitive conversation data via a URL, image request, or API call. Removing live network access cuts the exfiltration path — it does not prevent the injection from influencing what ChatGPT says.

Elevated Risk Labels

Running in parallel with Lockdown Mode, OpenAI is standardizing “Elevated Risk” labels across ChatGPT, ChatGPT Atlas, and Codex for features that involve live external network access. In Codex, enabling network access for documentation lookups now triggers a consistent Elevated Risk label with an explanation of what changes and what risks are introduced. OpenAI says the label is temporary — it will be removed once security advances sufficiently mitigate the associated risks for general use.

The pattern here is meaningful: AI platforms are beginning to treat security posture as a product feature, surfacing risk to end users rather than burying it in terms of service. Enterprise IT teams have long been able to configure these restrictions; Lockdown Mode extends that control to individuals.

The Broader Context

The expansion to personal accounts comes as AI systems with elevated real-world permissions become a primary attack surface. The Meta Instagram case was a confused deputy attack via an LLM. OpenAI’s Lockdown Mode addresses the analogous risk inside ChatGPT’s own surface.

Both cases point to the same structural issue: AI systems deployed with the ability to take real-world actions — resetting passwords, browsing the web, downloading files, calling external APIs — need deterministic guardrails for those actions, not just model-level refusal training. Lockdown Mode is one version of that guardrail. It trades functionality for a harder security perimeter. OpenAI says it is not intended for most users — it is designed for those who know what they are trading away and why.