OpenAI launches ChatGPT Lockdown Mode to limit exfiltration

OpenAI has begun rolling out Lockdown Mode for eligible accounts, describing it as "an optional advanced security setting that limits many tools and capabilities in OpenAI products that can connect to the web or external services." Per OpenAI's help center, Lockdown Mode is available to logged-in personal accounts across Free, Go, Plus, and Pro, and to self-serve ChatGPT Business accounts, with rollout that may be gradual. OpenAI announced the feature in a blog post published February 13, 2026 and updated June 4, 2026.

Per OpenAI's help article and blog, Lockdown Mode reduces data-exfiltration risk from prompt injection by limiting outbound network requests and restricting features that create external connectivity. OpenAI lists the following as disabled or limited when it is on:

• •Live web browsing, restricted to cached content only
• •Image support in responses and retrieving images from the web
• •Deep Research
• •Agent Mode
• •Canvas networking, which blocks approving generated code to access the network
• •File downloads for data analysis

OpenAI states the mode does not change memory, file uploads, sharing controls, or whether conversations may be used to improve models, and that it "does not guarantee that data exfiltration cannot happen," since risk can remain through enabled apps or unforeseen capability combinations.

Practitioners treat prompt injection as an active attack vector against connected LLM systems, where model outputs or tool integrations can become exfiltration channels. Lockdown-style controls shrink the attack surface by removing network-capable features an attacker could use to move data off-platform. For teams evaluating threat models, a toggle that trades connectivity for fewer outbound paths is a pragmatic mitigation layer alongside model hardening, sandboxing, and access controls.

OpenAI frames Lockdown Mode as part of a defense-in-depth approach that also includes sandboxing, monitoring, and enterprise controls such as role-based access and audit logs. For organizations handling sensitive data, a product-level setting that measurably reduces networked capabilities can simplify risk assessments, but OpenAI is explicit that it does not eliminate risk: injections embedded in uploaded files or cached content can still influence behavior even without external network access.

• •Whether security-conscious teams adopt Lockdown Mode by default in high-sensitivity environments.
• •Implementation guides or enterprise policy templates from OpenAI or partners.
• •New prompt-injection techniques that attempt to exfiltrate data through still-allowed channels.