OpenAI ChatGPT Lockdown Mode is an optional advanced security setting that limits the tools ChatGPT can use to reach the web or external services, cutting the risk of data exfiltration from prompt injection attacks. It disables live browsing, agent mode, and file downloads in exchange for tighter guardrails. It is built for high-risk users, not everyone.
OpenAI first introduced Lockdown Mode for enterprise plans in February 2026, then expanded it on June 4, 2026 to personal accounts — Free, Go, Plus, and Pro — plus self-serve ChatGPT Business. If you handle sensitive data, here’s exactly what it changes and whether flipping it on is worth the tradeoffs.
What Lockdown Mode actually protects against
The threat is prompt injection: a third party hides malicious instructions in a web page, file, or connected app, tricking ChatGPT into leaking data or taking unwanted actions. Lockdown Mode targets the final stage of such an attack — the outbound network request that would ship your data to an attacker.
Per OpenAI’s Help Center, it works by limiting outbound requests so sensitive data can’t easily leave OpenAI’s controlled network. Web browsing, for example, is restricted to cached content, so no live request leaves that boundary.
Crucially, it does not stop prompt injections from reaching ChatGPT in the first place. A malicious instruction inside an uploaded file can still skew an answer — Lockdown Mode just blocks the exfiltration payoff.
What gets turned off — and what stays on
Lockdown Mode deterministically disables a specific set of connected capabilities. Here’s the breakdown OpenAI documents:
| Capability | Status in Lockdown Mode |
|---|---|
| Live web browsing | Cached content only — no live requests |
| Image support in responses | Disabled (web-derived images) |
| Deep research | Disabled |
| Agent mode | Disabled |
| Canvas networking | Disabled |
| File downloads | Disabled |
| Image generation | Still works |
| Memory, file uploads, sharing | Unchanged |
| Model training / data controls | Unchanged (managed separately) |
One common misconception worth correcting: Lockdown Mode does not turn off model training. OpenAI states plainly that it “does not change whether your conversations may be used to improve models” — that stays in your separate data controls. It also does not affect network access in Codex.
For connectors, personal and self-serve Business accounts keep connectors that use synced data but lose live connector access and write actions. Shopping-agent experiences and Finances in ChatGPT go dark too.
Who Lockdown Mode is really for
OpenAI is blunt that this is not a default anyone should reach for. It describes the target user as “a small set of highly security-conscious users — such as executives or security teams at prominent organizations.”
If you’re a developer wiring ChatGPT into agentic workflows, a lawyer handling privileged files, or a security lead at a company that’s a juicy phishing target, the tradeoff makes sense. For casual users who rely on live browsing and Deep Research daily, it will mostly feel like friction. The broader context on why these risks are growing is covered in our guide to agentic AI security risks in 2026.
How to turn on Lockdown Mode
Enabling it on a personal or self-serve Business account takes four steps:
- Open Settings in ChatGPT.
- Select Security.
- Under Advanced security, toggle on Lockdown Mode.
- Confirm by selecting Turn on in the modal.
Two things to note. Lockdown Mode and Developer Mode can’t run at once — turning one on turns the other off. And you can disable Lockdown for a single chat via the status message above the composer, without switching it off globally. If you don’t see the option yet, it may not have reached your account.
OpenAI also rolled out standardized “Elevated Risk” labels across ChatGPT, ChatGPT Atlas, and Codex, flagging capabilities like Codex network access so users understand the risk before enabling them. To weigh which plan gives you the controls you need, see our 2026 AI subscription comparison.
Frequently Asked Questions
What is OpenAI ChatGPT Lockdown Mode?
It’s an optional advanced security setting that limits ChatGPT’s access to the web and external services to reduce the risk of data exfiltration from prompt injection attacks. It disables features like live browsing, agent mode, and file downloads while keeping core chat, uploads, and image generation working.
Does Lockdown Mode stop OpenAI from training on my chats?
No. OpenAI confirms Lockdown Mode does not change whether your conversations are used to improve models. That is controlled separately in your data controls, so you’ll need to adjust that setting on its own if training is your concern.
Which ChatGPT plans have Lockdown Mode?
As of June 2026 it is rolling out to eligible personal accounts including Free, Go, Plus, and Pro, plus self-serve ChatGPT Business. It was first introduced for enterprise plans like ChatGPT Enterprise, Edu, Healthcare, and for Teachers. Availability may vary by account.
Can I turn Lockdown Mode off for just one chat?
Yes. When Lockdown Mode is on, a status message appears above the composer. Select Manage, then “Turn off for this chat,” or use the more-options menu to set Lockdown to Disabled. This affects only the current conversation.
Does Lockdown Mode prevent all prompt injection attacks?
No. It substantially reduces the risk of data exfiltration but does not guarantee it can’t happen. A malicious instruction hidden in an uploaded file can still affect ChatGPT’s behavior or accuracy, and risk may remain through enabled apps or newly discovered techniques.
Lockdown Mode reflects a wider shift: as ChatGPT connects to more of your tools, security controls become a real differentiator between AI assistants. For how the major players stack up on capability and trust, read our Claude vs ChatGPT 2026 comparison.
