OpenAI has added a new security setting to ChatGPT called Lockdown Mode. It is optional, and most people will not need it. But for anyone regularly feeding sensitive information into ChatGPT, it is worth understanding what it does and why it exists.
The setting works by cutting off most of ChatGPT's connections to the outside internet. Live web browsing gets restricted to saved, cached content only. The AI can no longer fetch images from the web, download external files, or run its deeper research and automated task features. You still get the core question-and-answer experience, and you can still upload your own documents manually.
The threat Lockdown Mode guards against is called a prompt injection attack. The name sounds technical, but the idea is simple. A bad actor hides instructions inside content that ChatGPT will read: a webpage, a PDF, a spreadsheet. When the AI processes that content, it cannot tell the difference between legitimate text and hidden commands. It reads the hidden instructions and starts following them, the same way it follows your own requests. Those instructions can tell it to send your data somewhere outside the conversation.
This is not a future risk. In 2024, security researchers demonstrated a working attack on Slack's AI tool. By planting hidden instructions in a public Slack channel, an attacker could trick the AI into stealing data from private channels they had no access to. The attack produced a fake link labelled "click here to reauthenticate," and clicking it sent the user's private credentials directly to the attacker's server. The victim saw nothing unusual. Slack patched the flaw, but the pattern it revealed applies to any AI tool connected to the internet.
What Lockdown Mode does is close the exit route. It cannot stop a malicious instruction from appearing inside a document or cached page that ChatGPT reads. OpenAI is explicit about this: the hidden command can still get in and can still affect how the AI behaves or what it says. What the mode does is block the outbound network connections that an attacker would need to actually collect the stolen data. No live web call, no data transfer.
There is a real limitation here. If you have third-party apps connected to your ChatGPT account, those can still create risk. And if an injected instruction is in an uploaded file you send yourself, it can still distort the AI's answers even without exporting any data. Lockdown Mode reduces one specific pathway, not all of them.
OpenAI has also introduced a second, smaller feature alongside this: "Elevated Risk" labels on certain ChatGPT actions, such as clicking external links or connecting to another service. These are small warnings that appear before you do something that carries higher risk.
Who actually needs this? People and teams regularly using ChatGPT with sensitive data: contracts, financial projections, client records, personnel files, legal documents. If you are pasting that kind of material into ChatGPT and using features that pull content from the web, Lockdown Mode is a reasonable precaution. The setting is free, and you can turn it off for a single conversation if you need a feature it blocks.
The broader point is this: as AI tools get more connected and more capable, they also become more attractive targets. The Slack incident showed that the attack does not have to come from a sophisticated hacker. Anyone with access to your shared platform can plant a hidden instruction and wait. AI companies are building protections, but they are doing so while simultaneously making their tools more deeply integrated with business data. That tension is not going away.