OpenAI Rolls Out Lockdown Mode to Fight Prompt Injection Attacks

As AI use has skyrocketed in recent years, researchers are increasingly identifying prompt injection attacks as a critical security issue. These are attacks in which a bad actor misleads an AI model by injecting malicious instructions into a conversation, such as a PDF or website code designed to extract valuable company data.

Now, OpenAI is rolling out Lockdown Mode , an optional security setting that limits the ability of its products to connect to the web or external services. It does this by capping outbound network requests, though at the expense of some useful features. However, if you encounter malicious prompts, ChatGPT won't any data with third parties, acting as a final line of defense.

There are some pretty significant trade-offs for the added peace of mind. Once Lockdown Mode is enabled, web browsing is limited to cached content, so you might not see freshly updated web pages. Meanwhile, ChatGPT may not display images in regular responses or retrieve images from the web, but you can still upload image files and generate your own images.

In addition, ChatGPT won't be able to download files for data analysis, and users cannot approve Canvas-generated code to access the network. Deep Research and Agent Mode will also be disabled, and you won't be able to put ChatGPT into Developer Mode.

Though Lockdown Mode is available for all account types and workspaces, OpenAI says it's only intended for users and organizations handling sensitive data. To enable it, head to Settings > Security > Advanced Security > Lockdown Mode > Turn On .

OpenAI notes that while the new feature is designed to "substantially reduce" the risk of successful prompt injection-based data exfiltration in its products, it does not guarantee protection against newly discovered techniques or combinations of methods.

In August 2025, researchers at Anthropic compromised users of its Claude for Chrome browser extension with a 23.6% success rate via prompt injections while the product was still in beta. That same month, researchers at Brave demonstrated that Perplexity's Comet AI browser was also vulnerable to such attacks.