OpenAI has activated a new security feature called Lockdown Mode, designed to prevent the final stage of data theft from prompt injection attacks. The feature first teased by the company in February is now rolling out to eligible personal accounts, including Free, Go, Plus, and Pro tiers, as well as self-serve ChatGPT Business accounts.
Lockdown Mode works by limiting outbound network requests that could transfer sensitive data to an attacker. It directly targets the exfiltration vector, the channel through which stolen data leaves a system. According to a blog post by Simon Willison, Lockdown Mode does not stop prompt injections from appearing in content that ChatGPT processes. For example, an injection could still appear in cached web content or an uploaded file and might affect the behavior or accuracy of a response.
What Lockdown Mode Does
Lockdown Mode is a deterministic mechanism. It does not rely on AI systems to evaluate threats, which means it cannot be subverted by sufficiently devious attacks that might trick an AI-based defense. This is a crucial design choice because any security measure that itself uses an LLM could be manipulated. By cutting off the exfiltration path directly, OpenAI provides a layer of protection that is harder to bypass.
The feature is now live and rolling out across the supported account types. OpenAI describes Lockdown Mode as a way to combat the "Lethal Trifecta," a term for the combination of three elements that enable data theft in LLM systems: access to private data, exposure to untrusted content, and a way to steal and transmit data back to an attacker.
The Lethal Trifecta and How Lockdown Mode Breaks It
The Lethal Trifecta occurs when an LLM system has access to all three of these components. To stop an attack, a system must remove at least one leg of the triad. According to the analysis shared by Willison, the easiest leg to restrict without making LLM systems far less useful is the exfiltration vector. Lockdown Mode directly addresses that leg.
Stay ahead of the AI curve
The most important updates, news, and content — delivered weekly.
No spam. Unsubscribe anytime.
By limiting outbound network requests, the mode prevents the final step of a prompt injection attack. Even if an attacker successfully places a prompt injection in content the model processes, and even if the model is tricked into outputting sensitive data, that data cannot leave the system. The attacker cannot receive the stolen information.
Implications for ChatGPT Security
The existence of Lockdown Mode implies that ChatGPT, in its default settings, does not provide robust protection against sufficiently determined data exfiltration attacks. OpenAI is essentially acknowledging that without this additional measure, the system could be vulnerable to cases where a user or process feeds untrusted content to the model while it has access to private data.
This move is significant for developers and businesses that rely on ChatGPT for handling sensitive information. Users who handle confidential data should consider enabling Lockdown Mode to reduce the risk of data theft through prompt injection. The feature is available without extra cost to eligible accounts.
Lockdown Mode does not affect the model's ability to process content or generate responses. It only restricts outbound network requests. This makes it a relatively low-impact security enhancement that could be applied broadly without degrading functionality.
The rollout is ongoing. OpenAI has not specified a timeline for full availability, but the feature is now accessible to the account types listed.
Related on Neura Market
- AI Tools Directory - Explore other AI security and productivity tools
- Security & Privacy Solutions - Find resources for protecting your AI systems
- ChatGPT Plugins & Integrations - Discover ways to extend ChatGPT functionality