Last Updated on June 8, 2026 by Arnav Sharma
OpenAI’s ChatGPT Lockdown Mode is a direct response to a documented and growing attack class: prompt injection attacks that use ChatGPT’s own connected features as an exfiltration pipeline. The feature was announced on 13 February 2026 for ChatGPT Enterprise and expanded on 4-6 June 2026 to all personal accounts (Free, Go, Plus, Pro) and self-serve Business accounts. For security architects and enterprise IT teams evaluating AI governance posture, this is one of the more practically significant ChatGPT security settings released to date.
This article covers what ChatGPT Lockdown Mode is, the specific threat it addresses, exactly which features it disables and which remain active, how to enable it across different account types, its documented limitations, and how to deploy it sensibly across an organisation.
What Is ChatGPT Lockdown Mode?
ChatGPT Lockdown Mode is an optional, advanced security setting in ChatGPT that constrains how the model interacts with external systems. Its purpose is to reduce the risk of prompt injection-based data exfiltration by deterministically disabling outbound network channels that a malicious prompt could exploit to send sensitive data outside the conversation.
The key architectural distinction is important: Lockdown Mode is a deterministic control, not a probabilistic one. It does not attempt to detect or neutralise malicious prompts using model-level judgement, which is a limitation of the tools and capabilities in ChatGPT. Instead, it removes the outbound channels entirely. If a prompt injection cannot reach an external system, the exfiltration step in the attack chain fails regardless of whether the model was deceived by the injection.
OpenAI originally positioned the feature for “a small set of highly security-conscious users, such as executives or security teams at prominent organisations.” The June 2026 expansion makes it accessible to all logged-in ChatGPT users. Workspace admins at ChatGPT Enterprise, Edu, Healthcare, and Teachers plans can enable it via role-based access controls (RBAC) for specific user groups. Personal and self-serve Business users can toggle it from Settings > Security.
The Threat It Addresses: Prompt Injection and Data Exfiltration
To understand why Lockdown Mode is designed the way it is, it helps to understand the attack chain it is targeting.
Prompt injection occurs when malicious instructions are embedded in content that an AI model processes, such as a webpage retrieved during browsing, an uploaded document, or data returned by a connected app. Because large language models cannot reliably distinguish between authoritative system instructions and untrusted content, a well-crafted injection can cause the model to follow attacker-supplied directives. The OWASP Top 10 for LLM Applications (2025 edition) rates indirect prompt injection as one of the most significant vulnerabilities in deployed AI systems.
The attack becomes a data exfiltration incident when the injected instruction directs the model to send sensitive information to an attacker-controlled endpoint, typically via an outbound HTTP request initiated by a connected feature such as web browsing or an agent action.
Several documented incidents illustrate how this plays out in practice:
- ShadowLeak (September 2025): An indirect prompt injection flaw in ChatGPT’s Deep Research component, patched on 3 September 2025 and publicly disclosed on 18 September. The Register reported that Radware researchers subsequently identified related vulnerabilities fixed on 16 December 2025, all rooted in the same blind spot: the model’s inability to separate system instructions from untrusted content.
- ChatGPT memory exploit (2024): Researchers demonstrated a persistent prompt injection that manipulated ChatGPT’s memory feature, enabling data exfiltration across multiple conversations by embedding instructions in content the model stored in long-term memory.
- EchoLeak (June 2025): An indirect prompt injection vulnerability in Microsoft 365 Copilot (CVE-2025-32711, CVSS 9.3), unrelated to ChatGPT but demonstrative of how the same attack pattern affects all externally connected LLM deployments.
The pattern across all of these is identical: the model processes untrusted content, the untrusted content contains attacker instructions, the model follows those instructions via an outbound channel, and sensitive data leaves the environment. ChatGPT’s Agent Mode, live web browsing, Deep Research, and Canvas networking all provide that outbound channel.
Lockdown Mode is designed to close those channels deterministically.
What ChatGPT Lockdown Mode Disables (and What Stays On)
The following table reflects the restrictions documented in OpenAI’s announcement and Help Centre as of June 2026.
| Feature | Lockdown Mode OFF | Lockdown Mode ON |
|---|---|---|
| Live web browsing | Enabled | Restricted to cached content only; no live network requests leave OpenAI’s network |
| Deep Research (incl. shopping research) | Enabled | Disabled entirely |
| Agent Mode | Enabled | Disabled entirely |
| Image support in responses (web-sourced) | Enabled | Disabled |
| Canvas networking | Enabled | Disabled |
| Live connectors | Enabled | Disabled |
| File downloads for analysis | Enabled | Disabled; manually uploaded files still processed |
| Image generation (DALL-E) | Enabled | Enabled (no change) |
| Text generation and reasoning | Enabled | Enabled (no change) |
| Manually uploaded files | Enabled | Enabled (no change) |
| Developer Mode | Enabled | Mutually exclusive; cannot run simultaneously with Lockdown Mode |
For personal accounts, Lockdown Mode allows connectors that access already-synced data but blocks live access, write actions, and finance and shopping features. For enterprise workspaces, admins retain granular control over which apps and specific actions within those apps remain available to users in Lockdown Mode. This preserves critical business workflows while still restricting the highest-risk outbound pathways.
The trade-off is real. With Lockdown Mode on, ChatGPT loses the bulk of its agentic research capability. For users who rely on Deep Research or Agent Mode for legitimate non-sensitive work, the per-chat override allows disabling Lockdown Mode for a specific conversation without altering the global setting.
Elevated Risk Labels: The Companion Control
Alongside introducing Lockdown Mode, OpenAI standardised a set of “Elevated Risk” labels across ChatGPT, ChatGPT Atlas, and Codex. These are visual warning banners displayed on specific features where the security implications have not yet been fully mitigated at the platform level.
In Codex, for example, enabling network access for the coding assistant now triggers an Elevated Risk label with a clear explanation of what changes, what risks are introduced, and when that access is appropriate. In ChatGPT, the labels appear on capabilities that expose users to additional data exfiltration or manipulation risk.
The critical distinction from a security architecture perspective: Elevated Risk labels are informational. Lockdown Mode is deterministic. Labels surface risk and require the user to make a conscious decision. Lockdown Mode removes the capability. Both have their place depending on the user population and the risk tolerance of the organisation.
OpenAI has stated that Elevated Risk labels will be removed from a feature once security advances have sufficiently mitigated those risks for general use. The label set will also be updated over time as new high-risk capabilities are introduced.
How to Enable ChatGPT Lockdown Mode
Personal and Self-Serve Business Accounts
For personal ChatGPT accounts (Free, Go, Plus, Pro) and self-serve Business accounts, Lockdown Mode is enabled from Settings > Security. The toggle is available when the feature has rolled out to the account, with the June 2026 expansion making it available to all eligible accounts.
Two operational details worth noting for anyone managing their own deployment:
- Per-chat override: Users can temporarily disable Lockdown Mode for a single conversation without changing the global setting. This is the recommended approach when a non-sensitive task genuinely requires Agent Mode or Deep Research.
- Developer Mode incompatibility: Lockdown Mode and Developer Mode are mutually exclusive. Activating one disables the other. Teams using Developer Mode for agentic workflows will need to decide which posture applies to each use case.
Enterprise, Edu, Healthcare, and Teachers Plans
For managed ChatGPT plans, workspace admins enable Lockdown Mode through Workspace Settings by creating a new RBAC role with Lockdown Mode applied. Key operational details:
- Granular app control: Admins can specify exactly which connected apps, and which specific actions within those apps, remain available to users assigned the Lockdown Mode role. This prevents blunt capability removal from breaking legitimate critical workflows.
- Compliance API Logs Platform: Separate from Lockdown Mode, this provides detailed visibility into app usage, shared data, and connected sources. This is the audit trail component; pair it with Lockdown Mode for a complete picture of what users are doing in the environment.
- Role scoping: The intended deployment pattern is to apply Lockdown Mode to specific high-risk roles (executives, legal, compliance, security teams, HR) rather than as a blanket organisation-wide setting. Roles that do not regularly handle sensitive data and depend on agentic features should not be forced into Lockdown Mode without a per-chat override option.
What ChatGPT Lockdown Mode Does Not Fix
OpenAI is explicit about the limitations of Lockdown Mode, and any serious security evaluation should account for them.
The most important limitation: Lockdown Mode does not prevent prompt injections from appearing in content that ChatGPT processes. A malicious instruction embedded in an uploaded PDF, a cached webpage, or content returned by an enabled connector can still reach the model and influence its behaviour, including what it says in the conversation.
OpenAI’s stated position: “Lockdown Mode is designed to substantially reduce the risk of prompt injection-based data exfiltration in ChatGPT and supported OpenAI products, but it does not guarantee that data exfiltration cannot happen. Risk may remain through enabled apps, unforeseen combinations of capabilities, or newly discovered techniques.”
The protection is specifically against the exfiltration step: malicious instructions cannot use ChatGPT as a pipeline to transmit data to an attacker-controlled endpoint via the disabled channels. They can still affect model responses. If an attack’s goal is to deceive the user by changing what ChatGPT outputs in the conversation, Lockdown Mode offers no protection. If the goal is data theft via an outbound channel, removing those channels breaks the attack chain.
Additional limitations:
- Enabled apps remain a risk surface. For enterprise deployments where admins have retained specific connected apps in the Lockdown Mode role, those apps’ actions represent residual exfiltration pathways.
- Cached content is not sanitised. Live browsing drops to cached content only, but cached pages can still contain injected instructions that influence model behaviour.
- Agentic capability loss is significant. For security teams that depend on ChatGPT’s Deep Research or Agent Mode as part of their own workflows (threat intelligence research, automated report generation), Lockdown Mode imposes a real productivity cost.
Who Should Enable ChatGPT Lockdown Mode?
The feature is explicitly “not intended for everyone,” per OpenAI. The target population is users whose profile makes them high-value targets for data exfiltration:
- Executives and board-level staff regularly discussing sensitive business, financial, or strategic information
- Security operations and incident response teams feeding threat intelligence, incident data, or customer information into ChatGPT for analysis
- Legal and compliance teams pasting contracts, regulatory submissions, or M&A documents
- HR teams processing personnel data, performance reviews, or sensitive employee information
- Finance teams working with unreleased financial data, earnings forecasts, or client financial records
For these roles, enabling Lockdown Mode as the global default and using per-chat override for legitimate non-sensitive tasks is a reasonable operating posture.
For engineering and development teams using Agent Mode or Deep Research as core workflow tools, a blanket Lockdown Mode mandate will create friction without proportionate benefit. A better approach is to scope Lockdown Mode to specific data-handling contexts and use Elevated Risk labels to raise awareness for the broader user population.
The comparison to Apple’s Lockdown Mode is conceptually accurate: a higher-friction security state intended for a specific at-risk population, not a universal recommendation.
Deploying ChatGPT Lockdown Mode Across Your Organisation
For enterprise security architects planning a deployment, the following approach reflects the design intent of the feature:
1. Map roles to data sensitivity. Identify which staff functions regularly process sensitive data in ChatGPT. Legal, HR, finance, security operations, and C-suite communications are the typical high-priority groups. Engineering and research teams working with non-sensitive data can be excluded from mandatory Lockdown Mode without losing the security posture benefit.
2. Create scoped RBAC roles. In ChatGPT Enterprise Workspace Settings, create a dedicated Lockdown Mode role and assign it to the identified groups. Audit the connected apps and actions you need to preserve for those roles and configure exceptions carefully.
3. Enable Compliance API Logs. Pair Lockdown Mode with the Compliance API Logs Platform to maintain visibility into app usage, shared data, and connected sources. This is the evidence trail your security team needs if an incident occurs.
4. Communicate the per-chat override. Users assigned Lockdown Mode who need Agent Mode or Deep Research for a specific non-sensitive task should use the per-chat override. If they do not know this is available, they will either disable Lockdown Mode globally for convenience or avoid the feature entirely. Neither outcome serves the security objective.
5. Layer with existing controls. ChatGPT Lockdown Mode addresses the exfiltration channel within ChatGPT. It does not replace DLP policies, CASB controls, or network egress filtering. An AI prompt containing sensitive data that is submitted to ChatGPT in the first place is outside the scope of what Lockdown Mode addresses. User training on what data types are appropriate to process in any external AI system remains a necessary control layer.
What’s Next for ChatGPT Security
The June 2026 expansion of Lockdown Mode to personal accounts and self-serve Business accounts is a meaningful shift in availability, but the underlying challenge has not changed. Large language models cannot reliably separate trusted instructions from untrusted content at the model level. That is a research problem the field has not solved. Lockdown Mode represents what OpenAI describes as a “defense-in-depth” approach: acknowledging the model-level limitation and building deterministic controls around it.
Alongside the Lockdown Mode expansion, OpenAI rolled out an Active Sessions feature allowing users to review where their account is signed in, with device type, approximate location, and sign-in time visible. This gives individuals and admins a session-management tool to identify and terminate suspicious access, which is the account takeover variant of the same data theft threat.
OpenAI has committed to removing Elevated Risk labels from specific features as security advances sufficiently mitigate those risks. The implication for security teams: the label set will change over time, and periodic review of which features carry Elevated Risk designations should be part of regular AI governance reviews.
The broader trajectory across the industry points in the same direction. Security researchers have demonstrated prompt injection hijacks against agents from Anthropic, Google, and Microsoft via GitHub Actions integrations. All three paid bug bounties without public advisories. The attack surface grows with every new capability added to agentic AI systems, and perimeter-style controls like Lockdown Mode are likely to become standard across enterprise AI platforms as that surface expands.
I help organisations secure their cloud infrastructure and stay ahead of evolving cyber threats. Microsoft MVP and Certified Trainer, author of Mastering Azure Security, and founder of arnav.au — a platform for practical Cloud, Cybersecurity, DevOps and AI content.