OpenAI unveils Lockdown Mode to protect sensitive data from prompt injection attacks

OpenAI has introduced Lockdown Mode, a ChatGPT setting that disables several live-data features to reduce the risk of prompt injection attacks and subsequent data exfiltration for users handling sensitive information [1]. The new mode disables live web browsing, the retrieval and display of images from the web, deep research, and agent mode [1]. OpenAI stated that even with Lockdown Mode active, ChatGPT could still be vulnerable to prompt injections, which might appear in cached web content or uploaded files and affect the behavior or accuracy of a response [1]. The feature is designed to limit the attack surface for data exfiltration rather than eliminate all injection risks [1]. "Lockdown Mode is not intended for everyone," OpenAI said, describing it as a tool for people and organizations that handle sensitive data and want stricter protection [1]. The rollout is currently reaching self-serve ChatGPT Business accounts and eligible personal accounts [1]. Prompt injection has been a persistent concern since ChatGPT's public release in November 2022, which accelerated a period of rapid investment and public attention toward artificial intelligence [8]. The chatbot, which reached 100 million monthly active users within two months of launch, has faced criticism for its potential to generate misinformation and for security vulnerabilities [8]. OpenAI's broader product ecosystem has also drawn scrutiny; its ChatGPT Atlas browser, based on Chromium, includes an optional agent mode that can carry out tasks on websites and has been criticized over reported security vulnerabilities involving its memory features [9]. The introduction of Lockdown Mode arrives as agentic AI systems—capable of autonomous perception, reasoning, and tool use—are being tested across specialized domains. A pilot study evaluating agentic multimodal AI systems for digital pathology found that while the systems could meaningfully engage with web-based slide viewing software, diagnostic precision remained limited compared with a human expert, achieving up to 28.6% accuracy with images and signalment provided versus 85.7% for a board-certified pathologist [7]. In clinical reasoning benchmarks, a multi-agent diagnostic intelligence agent achieved a score of 0.6272 on the HealthBench Professional benchmark, with performance lift attributed to system architecture including specialty routing and safety gating [3]. OpenAI's move to restrict feature access for security purposes reflects a design trade-off between capability and safety. The company's o1 reasoning model, released in preview in September 2024, was built to spend time "thinking" before answering, improving performance on complex reasoning tasks [10]. Lockdown Mode applies a different philosophy—removing capabilities rather than adding reasoning steps—to address a specific threat vector. The feature is rolling out now [1].