ChatGPT Lockdown Mode and Elevated Risk Labels

OpenAI has introduced Lockdown Mode and an "Elevated Risk" labeling system to protect users from prompt injection attacks and prevent unauthorized data exfiltration. These tools provide a defense-in-depth approach to security, allowing high-risk users and organizations to trade some product functionality for stricter guardrails.

Lockdown Mode: Deterministic Security for High-Risk Users

Lockdown Mode is an optional, advanced security setting designed for users with higher security needs, such as executives or security teams, to reduce the risk of prompt injection-based data exfiltration. When enabled, it tightly constrains how ChatGPT interacts with external systems by deterministically disabling or limiting specific tools and capabilities.

Key Restrictions in Lockdown Mode

To prevent sensitive data from being shared outside the conversation, Lockdown Mode limits or turns off the following features:

  • Live Web Access: Web browsing is limited to cached content, ensuring no live network requests leave OpenAI's controlled network.
  • Image Support: Image support in responses is disabled.
  • Deep Research: Including shopping research capabilities.
  • Agent Mode and Canvas Networking: These connected features are disabled.
  • Live Connectors and File Downloads: These are turned off to reduce the attack surface for prompt-injection-style attacks.

Availability and Administration

Lockdown Mode was first introduced for ChatGPT Enterprise, Edu, Healthcare, and Teachers plans. As of June 4, 2026, it has rolled out to personal ChatGPT accounts and self-serve ChatGPT Business accounts.

For organization admins, Lockdown Mode layers additional restrictions on top of existing admin settings. Admins can enable it via Workspace Settings by creating a new role. To maintain critical workflows, admins retain granular control over which specific apps and actions within those apps remain available to users in Lockdown Mode.

Elevated Risk Labels: Standardized Risk Communication

OpenAI is standardizing the use of "Elevated Risk" labels to provide consistent guidance across ChatGPT, ChatGPT Atlas, and Codex. These labels are applied to capabilities that introduce network-related risks that are not yet fully addressed by industry-wide safety mitigations.

Implementation and Purpose

The "Elevated Risk" label informs users when they are enabling features—such as network access in Codex for looking up documentation—that may introduce additional security risks. This allows users to make informed choices about whether to use these features when working with private data.

OpenAI states that these labels will be removed once security advances have sufficiently mitigated the risks for general use, and the list of features carrying the label will be updated over time.

Defense-in-Depth Strategy

OpenAI's security approach focuses on providing practical protections as AI systems become more capable and connected. By combining deterministic settings like Lockdown Mode with transparent risk labeling, OpenAI aims to mitigate the emerging risk of prompt injection, where third parties attempt to mislead AI systems into revealing sensitive information or following malicious instructions.

Sources