With the new Lockdown Mode, ChatGPT users can disable web access, Deep Research, and Agent Mode to better protect themselves against data theft through prompt injection attacks. The feature is aimed primarily at users handling sensitive data.

Lockdown Mode restricts all features that connect ChatGPT to the internet or external services. The goal is to prevent attackers from using prompt injections, hidden instructions embedded in text or files, to manipulate the model's behavior and exfiltrate sensitive user data. OpenAI says the feature is designed for individuals and organizations working with particularly sensitive data.

Live web search gets limited to cached content, which means search results may be outdated or unavailable entirely. Deep Research and Agent Mode are fully disabled. ChatGPT can no longer download files and won't display web images in regular responses. Network access for Canvas-generated code is blocked too.

Prompt injection remains an unsolved problem

OpenAI calls prompt injection a "frontier, challenging research problem" it's working to solve. That's true, but only part of the story: prompt injections have been a well-known LLM vulnerability since at least GPT-3, frequently exploited, and years of research still haven't produced a fix.

Lockdown Mode confirms that status quo: it's a band-aid, not a fix for prompt injections. It builds on existing defenses, including sandboxing, URL-based exfiltration protection, monitoring, and access controls. But a manipulative instruction hidden in an uploaded file can still influence the model's behavior and lead to wrong answers, OpenAI says. The mode only blocks the final step in an exfiltration chain, the attempt to send data to an attacker via network requests.

OpenAI's FAQ states that prompt injection "is not currently a major risk," but the impact "could grow as attackers develop more sophisticated methods." Lockdown Mode doesn't guarantee complete protection. That's something you might want to keep in mind before linking your financial data into ChatGPT.

Users can toggle the mode off per chat

For personal accounts and self-managed ChatGPT Business accounts, Lockdown Mode can be enabled under "Settings > Security." In managed workspaces, admins can set up the mode through role-based access controls (RBAC) for individual members or groups.

Users can temporarily turn off Lockdown Mode for specific chats when they need full functionality for a particular conversation. Lockdown Mode and Developer Mode are mutually exclusive, though.

For apps and connectors, OpenAI draws distinctions by account type. On personal accounts, Lockdown Mode allows connectors that access already-synced data but blocks live access, write actions, and finance and shopping features. In managed workspaces, OpenAI recommends admins only enable trusted apps and evaluate each one's exfiltration risk individually.

AI News Without the Hype – Curated by Humans

Subscribe to THE DECODER for ad-free reading, a weekly AI newsletter, our exclusive "AI Radar" frontier report six times a year, full archive access, and access to our comment section.

Subscribe now