ChatGPT Lockdown Mode: Deterministic ‘Disable the Hands’ When Classifiers Aren’t Enough

Prompt injection remains an unsolved frontier problem for tool-using agents. Shipping a blunt, deterministic “disable the hands” mode acknowledges that classifier-only defenses are insufficient for high-stakes users—and that product security will increasingly be a spectrum of capability vs. containment rather than a binary safe/unsafe model.

OpenAI’s Lockdown Mode moved into broader consumer and self-serve Business availability as a hard opt-in defense against prompt-injection attacks that try to siphon conversation or connected-app data. Covered widely on June 6 by TechCrunch, The Hacker News, and PCMag, the mode trades features—especially live web browsing and some agentic outbound actions—for tighter limits on outbound requests. OpenAI states it substantially reduces exfiltration risk but does not claim perfect protection.

How Lockdown Mode works

From OpenAI product documentation and contemporaneous security reporting:

• Purpose: Reduce the final stage of data exfiltration when hidden malicious instructions (in web pages, files, or other content) try to make ChatGPT leak secrets or call external sinks.
• Mechanism: Deterministically disables or constrains tools and capabilities an adversary could exploit for outbound data movement (e.g., live web browsing, certain image retrieval, Agent Mode behaviors).
• Trade-off: Users lose convenience features that require external connectivity; OpenAI positions it as unnecessary for most users but valuable for high-sensitivity contexts.
• Limits (OpenAI’s own caveats): Injections can still appear in cached web content or uploaded files and affect response behavior/accuracy; Lockdown Mode is not a guarantee of zero exfiltration.
• Availability: Help-center/update language notes rollout to personal ChatGPT accounts and self-serve ChatGPT Business; enable via Settings → Security → Advanced Security → Lockdown Mode.
• History: Feature family introduced earlier in 2026 with Elevated Risk labels; June update expands who can turn it on.

Limits

• OpenAI itself: residual injection risk in cached content and uploads remains.
• Broader personal/self-serve Business rollout—Enterprise admin policy paths may differ.
• Not a substitute for zero-trust enterprise DLP on connected apps.

Sources

• OpenAI Help: Lockdown Mode documentation (help.openai.com/en/articles/20001061-lockdown-mode).
• OpenAI product update language on June 2026 personal/self-serve Business rollout (openai.com index / related Lockdown Mode post updates).
• TechCrunch, The Hacker News, PCMag coverage (June 6, 2026) detailing feature trade-offs and residual risk language.