Before you give an AI assistant a sensitive document, separate two questions. Can outside material manipulate its answer? Can it send your information somewhere you did not intend? ChatGPT’s Lockdown Mode is designed to reduce the second risk by limiting outbound network access. OpenAI says it does not prevent malicious instructions from appearing in material the assistant reads, and it does not guarantee that data exfiltration cannot happen. OpenAI says residual exfiltration risk may remain through enabled apps, unforeseen combinations of capabilities, or newly discovered techniques. That distinction should determine how you use it. OpenAI’s current guide spells out both the protection and its limits.
This is a documentation-based explainer, not a penetration test. The workflow recommendations below are our interpretation of the documented controls. We have not measured an attack success rate or verified how the setting behaves on every account.
Understand the failure you are trying to prevent
OpenAI describes prompt injection as instructions placed in external content to make a model do something its user did not request. In its security discussion, the company says effective attacks can resemble social engineering. A document does not have to announce that it is malicious. It can claim that a disclosure is part of an approved process. The danger comes when the assistant treats that outside claim as permission. OpenAI explains this threat model here.
Imagine asking an assistant to summarize a supplier’s proposal. A paragraph tells it to send your internal notes to a supposed verification service. That is an illustrative scenario, not a reported incident. Your request was to summarize the proposal. The proposal’s author does not get to authorize another use of your information.
OpenAI frames the problem as a source of influence combined with a dangerous capability. Reading untrusted content and transmitting information are different parts of the failure. Its argument is that defenses should constrain the consequences even when manipulation succeeds. Lockdown Mode applies that idea through restrictions on network-connected capabilities. It should not be read as a promise that every answer becomes reliable.
A recent disclosure illustrates why this is risk reduction, not a guarantee. On November 5, 2026, Check Point Research described an HTML-preview sandbox bypass that had defeated Lockdown Mode. The researchers say OpenAI informed them on September 18 that a fix was deployed, and their retest confirmed the described technique no longer worked. This is the researchers’ account, not evidence that the same bypass remains exploitable today. Read the original researcher disclosure.
What you give up
According to the current help page, live browsing becomes limited to cached content. Results may be stale, limited, or unavailable. Deep research and agent mode are disabled. ChatGPT cannot download files for data analysis. Canvas-generated code cannot receive approval to access the network. Image support in ordinary responses is limited, although image generation remains available where it is otherwise available, and you can still upload images. Those are product restrictions, not suggestions for prompts.
For a job that depends on current information, the cached-content restriction matters immediately. Do not ask for a live product availability check and assume the answer reflects the store right now. Instead, use an independently checked source or stop the task until you have a suitable approved workflow. That is our recommendation based on OpenAI’s freshness warning, not a claim that cached results are always wrong.
For analysis of a document you already possess and are authorized to share, the tradeoff may be easier to accept. OpenAI says ChatGPT can still work on manually uploaded files. Use a minimal document that contains what the task needs. The ability to upload a file is not a reason to include unrelated personal or business information.
What does not change
Lockdown Mode does not change memory, file uploads, conversation sharing, or whether conversations may be used to improve models. OpenAI says many of those settings can be configured separately by workspace admins; workspace data controls depend on the plan and settings. It also says Lockdown Mode does not affect network access in Codex. Do not extend the protection to another product because the account or brand looks familiar.
This is the most useful comparison to make before using the setting. Network restrictions address where some information can go during a task. Training controls address a different question about how conversation data may be used. File selection determines what information you supply. Treat these as separate decisions and review the actual setting for each one.
The documentation also warns that malicious instructions in an uploaded file or cached content can still affect behavior or accuracy. An answer that stays inside the conversation can still be wrong. Keep your source checks, especially when the output will guide a consequential decision or be published under your name.
Connected apps need their own review
The current guide distinguishes personal and self-serve Business accounts from managed workspaces. On personal and self-serve Business accounts, Lockdown Mode blocks live external-service access and app write actions when they conflict with its protections. For managed workspaces, app and MCP access depends on workspace settings and role-based controls. Lockdown Mode does not automatically disable every app there. Some connected experiences, including Finances in ChatGPT and shopping-agent experiences, are unavailable in Lockdown Mode. For managed workspaces, OpenAI recommends enabling only trusted apps and necessary actions. App access in ChatGPT does not override permissions in the connected source system.
OpenAI also distinguishes an app reading sensitive data from an app creating a visible side effect. Its guidance says trusted read actions can still expose sensitive information that an attacker may try to extract. Write actions need more caution because they create side effects, and broad or uncertain visibility is a concern. A label that says an app is connected does not answer who will see a particular action.
Our recommendation is to review the specific action before starting. Identify the source account, the information needed, the destination, and who can see the result. If you cannot establish those facts, narrow the task. Do not rely on a general instruction to be careful as a replacement for access controls.
A practical decision before your next task
First, check availability. OpenAI says Lockdown Mode requires a signed-in account, and support depends on the plan, workspace, product, rollout, and administrator configuration. Eligible personal and self-serve Business users can find it under Settings, then Security, then Advanced security. Managed workspaces use role-based controls. OpenAI’s RBAC guide says workspace Owners create and assign custom roles; Admins may be able to view or update existing roles through supported surfaces. Do not assume another person’s screenshot proves your account has the same options.
Next, decide whether the task needs live research or agent actions. If it does, the documented restrictions may make Lockdown Mode the wrong workflow for that task. That is a reason to redesign the task, not to quietly switch protection off around sensitive material. OpenAI allows disabling the mode for an individual chat on the web. Make that an explicit decision rather than an automatic troubleshooting step.
Finally, check the output against its sources and inspect any proposed transmission before approving it. Lockdown Mode reduces particular opportunities for data to leave. It does not certify your sources, set your training preference, or replace judgment about what the assistant should be allowed to do. Use it for the problem it addresses, and keep the other checks in place.