OpenAI adds a Lockdown Mode toggle and "Elevated Risk" labels to ChatGPT

What Lockdown Mode actually turns off

Lockdown Mode is an optional setting that strips ChatGPT of the features that connect it to the outside world. When enabled, it limits or disables live web access, image support in responses, Deep Research including shopping research, Agent Mode, Canvas networking, live connectors, and file downloads.

The reasoning is explicit: each of these is a path by which a prompt-injection attack could push information out of the conversation. Web browsing, for instance, is restricted to cached content so that no live network requests leave OpenAI's controlled network. Where OpenAI can't guarantee data safety deterministically, the feature is turned off entirely rather than warned about.

OpenAI is direct that this is not for everyone. It describes the target user as "a small set of highly security-conscious users—such as executives or security teams at prominent organizations," and states plainly that "it is not necessary for most users."

The word "deterministic" is doing real work

OpenAI repeatedly calls Lockdown Mode a deterministic setting. That word choice matters. Most model-level safety is probabilistic—a classifier or a trained behavior that usually holds. Lockdown Mode instead removes capabilities at the product layer, so the protection doesn't depend on the model correctly resisting a malicious instruction.

Lockdown Mode deterministically disables certain tools and capabilities in ChatGPT that an adversary could attempt to exploit to exfiltrate sensitive data from users' conversations or connected apps via attacks such as prompt injections.Montana Labs

This is a frontend and systems answer to a problem that model training alone hasn't solved. OpenAI frames it as one layer in a "defense-in-depth" approach that already includes sandboxing, URL-based exfiltration protections, monitoring, and enterprise controls like role-based access and audit logs. Lockdown Mode is the layer that gives up functionality in exchange for a guarantee.

Elevated Risk labels standardize a warning users already needed

The second change is smaller in scope but arguably broader in reach. OpenAI is applying a consistent "Elevated Risk" label to a short list of existing capabilities across ChatGPT, ChatGPT Atlas, and Codex.

The Codex example is concrete: when a developer grants Codex network access so it can look up documentation, the settings screen now carries the label along with an explanation of what changes, what risks appear, and when that access is appropriate. The capability isn't new—the labeling and the consistency across surfaces are.

OpenAI treats the labels as temporary. It says it will remove the "Elevated Risk" label from a feature once security advances have "sufficiently mitigated those risks for general use," and will add the label to other features over time. The label is a moving indicator of where the safety work is still catching up to the capability.

The rollout path from enterprise to personal accounts

Lockdown Mode launched first on enterprise plans—ChatGPT Enterprise, Edu, Healthcare, and Teachers—where admins enable it in Workspace Settings by creating a new role, layering restrictions on top of existing admin controls. Admins can still choose exactly which apps and which specific actions within them stay available in Lockdown Mode, so critical workflows aren't forced offline wholesale.

A June 4, 2026 update records the expansion: Lockdown Mode is now rolling out to personal ChatGPT accounts and self-serve Business accounts, reachable from Settings > Security. The original February post had promised consumer availability "in the coming months," and the update confirms it arrived.

The implication: prompt-injection defense becomes a visible user choice

The specific thing OpenAI did here is move prompt-injection risk out of the model's hidden behavior and onto the surface of the product. Lockdown Mode is a switch; Elevated Risk is a label. Both put the decision—and the trade-off between functionality and safety—in the user's hands rather than resolving it silently.

For teams building on connected AI features, that's the signal worth reading. OpenAI is conceding that some network-related capabilities "aren't yet fully addressed by the industry's safety and security mitigations," and its response is to make that gap explicit rather than paper over it. When the safety story depends on which toggles and roles are set, the frontend is no longer just where the feature lives—it's where the security posture is decided.