New ChatGPT Lockdown Mode Aims to Block Prompt Injection and Data Exfiltration Attacks

OpenAI this week introduced Lockdown Mode, a security-focused setting for ChatGPT designed to reduce the risk of data exfiltration from prompt-injection attacks.

The feature is rolling out to eligible personal accounts (Free, Go, Plus, Pro) and self-serve ChatGPT Business workspaces, and managed-workspace administrators can assign a Lockdown Mode role to members.

Prompt injection is a growing threat in which attackers inject malicious instructions into user input, uploaded files, or cached web content to trick a model into revealing or sending sensitive data.

Lockdown Mode does not stop malicious prompts from appearing. However, it limits the toolset a model can use to move data off the platform, the final step attackers often need.

ChatGPT Lockdown Mode

Lockdown Mode applies restrictions across product, model, and system layers, extending existing sandboxing and URL protections with stricter controls on outbound network interactions.

When enabled, ChatGPT disables or limits capabilities that can create live external network requests or perform write actions. Key disabled or limited features include live web browsing (only cached content is available and search results may be stale), image retrieval and display from the web (users can still upload images), deep research and agent mode, Canvas-generated code network approvals, and automated file downloads for data analysis (manual uploads remain usable).

The goal of these restrictions is to block exfiltration channels, even if a prompt injection succeeds in altering the model’s behavior.

Apps and connectors behave differently depending on account type and workspace settings. For personal and self-serve business accounts, Lockdown Mode allows read access to synced connectors while blocking live connector access and connector write actions; some connected experiences, such as finance and shopping agents, are unavailable.

For managed workspaces, admins retain fine-grained control: Lockdown Mode does not automatically disable every app, connector, or action.

Workspace administrators should review roles, app assignments, and required read/write actions because a member may be unable to use an app if their role limits capabilities, the app is not assigned to them, or they lack access to the underlying source system. App access in ChatGPT does not override permissions in the connected source system.

OpenAI provides risk guidance for administrators when configuring apps for members using Lockdown Mode. High-risk items include read or write actions for untrusted apps and write actions for trusted apps with broad or uncertain visibility; these are not recommended.

Medium-risk items include synced connectors and read actions for trusted apps, which are lower risk because they do not create new network requests but can still be sources of sensitive data. Administrators should avoid enabling write actions unless they are confident that side effects are visible only to trusted people.

To maintain oversight, admins can use role-based access control (RBAC), app allowlists, audit logging, and the Compliance API Logs Platform to get detailed visibility into app usage, shared data, and connected sources.

Lockdown Mode comes with trade-offs: it reduces functionality and convenience. It is intended for users and organizations that handle sensitive data and are willing to accept reduced features in exchange for stronger protection. It is not a silver bullet: it does not eliminate prompt injection risk inside processed content, nor does it affect Codex network access.

Still, by limiting outbound requests and write-capable actions, Lockdown Mode is a practical mitigation that reduces exfiltration vectors. Organizations should evaluate enabling it alongside app governance, RBAC, and logging to reduce the risk that a prompt injection escalates into a breach.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.