Chronicle/Defense & research

OpenAI adds Lockdown Mode and Elevated Risk labels to ChatGPT to limit prompt injection exfiltration

Feb 13, 2026DefenseTool releaseSignificance assistant-drafted

OpenAI introduced Lockdown Mode, an optional setting that deterministically disables or limits capabilities an attacker could exploit through prompt injection, such as live web access, image support in responses, Deep Research, Agent Mode, live connectors and file downloads. Elevated Risk labels flag network-related features in ChatGPT, Atlas and Codex that carry extra risk. Lockdown Mode first launched for enterprise-type plans, and a June 4, 2026 update says it is rolling out to personal and self-serve Business accounts.

Why it matters

A major vendor chose to offer capability removal, not only detection, as the stronger control for high-risk users.

Key facts

As stated in the sources, with where to find them.

Initial availability: ChatGPT Enterprise, Edu, ChatGPT for Healthcare and ChatGPT for Teachers; admins enable it in Workspace Settings by creating a role.OpenAI post, 'Helping organizations protect employees' section
In Lockdown Mode, web browsing is limited to cached content so no live network requests leave OpenAI's network; features without strong deterministic data-safety guarantees are disabled.OpenAI post, 'Helping organizations protect employees' section
A June 4, 2026 update says Lockdown Mode is rolling out to personal and self-serve ChatGPT Business accounts.OpenAI post, update note

Findings that cite this record

Jun 10, 2025

Limiting what untrusted input can cause an agent to do gives injection resistance that does not depend on the model resisting.

Corroboratedargued5 evidence records

Key questions this bears on

Can prompt injection against AI agents be reliably defended?Not reliably. Defenses reduce injection but none has eliminated it; limiting what untrusted input can trigger is the most defensible approach.

Sources

Introducing Lockdown Mode and Elevated Risk labels in ChatGPTOpenAIFeb 13, 2026Primary sourceAccessed Sep 25, 2026
ChatGPT gets new security feature to fight prompt injection attacksHelp Net SecurityFeb 16, 2026Secondary sourceAccessed Sep 25, 2026

Related records

Jan 28, 2026

OpenAI describes Safe Url check that only auto-fetches URLs already seen publicly to block exfiltration

DefenseTool releaseOpenAI

Jan 19, 2026

Miggo finds Gemini calendar-invite injection that bypassed privacy controls on meeting data

AttackVulnerability disclosureMiggo Security, Google

Aug 6, 2025

Zenity AgentFlayer: zero-click connector attacks on ChatGPT, Copilot Studio and other agents

AttackVulnerability disclosureZenity, OpenAI, Microsoft

Oct 31, 2025

Meta proposes the 'Agents Rule of Two' for limiting prompt injection impact

DefenseFrameworkMeta

Oct 8, 2025

CamoLeak: hidden PR comments let GitHub Copilot Chat leak private code via image proxy

AttackVulnerability disclosureLegit Security, GitHub

Sep 25, 2025

ForcedLeak: Web-to-Lead prompt injection could make Salesforce Agentforce leak CRM data

AttackVulnerability disclosureNoma Security, Salesforce

Organizations: OpenAI
Topics: Prompt injection Data exfiltration Access controls
Attack surface: Tools & MCP Untrusted content
Methods: Data exfiltration through agents Restricting what agents can reach Indirect prompt injection
Record: openai-lockdown-mode-elevated-risk-2026 · added 2026-09-25

Cite this record

Fide AI. "OpenAI adds Lockdown Mode and Elevated Risk labels to ChatGPT to limit prompt injection exfiltration." Agentic Cyber Explorer, record openai-lockdown-mode-elevated-risk-2026. https://agentic-cyber-explorer.pages.dev/events/openai-lockdown-mode-elevated-risk-2026/ (corpus as of 2026-09-26).

BibTeX

@misc{fide-ace-openai-lockdown-mode-elevated-risk-2026,
  author = {{Fide AI}},
  title = {OpenAI adds Lockdown Mode and Elevated Risk labels to ChatGPT to limit prompt injection exfiltration},
  howpublished = {Agentic Cyber Explorer},
  year = {2026},
  url = {https://agentic-cyber-explorer.pages.dev/events/openai-lockdown-mode-elevated-risk-2026/},
  note = {Record openai-lockdown-mode-elevated-risk-2026; corpus as of 2026-09-26}
}

Data: JSON · CC BY 4.0

Spotted an error? Suggest a correction.