OpenAI introduced two new protections designed to help users and organizations mitigate prompt injection attacks when it launched Lockdown Mode in February. Last week, the LLM giant announced rollout of Lockdown Mode to all personal ChatGPT accounts, including Free, Go, Plus, and Pro, and also self-serve ChatGPT Business accounts. Users can enable it from ChatGPT Settings under Security.

The rollout is notable not just for what Lockdown Mode does, but for what its existence concedes.

Does the existence of Lockdown Mode imply that ChatGPT, in its default settings, does not provide robust protection against sufficiently determined data exfiltration attacks. OpenAI does not seem to dispute this. Lockdown Mode is designed to help prevent the final stage of data exfiltration from a prompt injection attack by limiting outbound network requests that could transfer sensitive data to an attacker. Lockdown Mode does not prevent prompt injections from appearing in the content ChatGPT processes.

That distinction matters enormously. Lockdown Mode is not an anti-injection control. It is a last-line-of-defense control. OpenAI is not stopping malicious instructions from reaching the model — it is blocking the network paths those instructions might use to smuggle data out. The attack still happens; the payload just has nowhere to go.

Also read: OpenAI’s New Enterprise Security Mode Locks Down ChatGPT Against Prompt Injection

What Prompt Injection Actually Is

Prompt injection is the attack class Lockdown Mode is designed to constrain. In these attacks, a third party attempts to mislead a conversational AI system into following malicious instructions or revealing sensitive information.

In a connected AI system — one that browses the web, processes documents, or interacts with external tools — the attack surface is every piece of external content the model touches. A malicious instruction embedded in a webpage, a PDF, a calendar invite, or a shared document can hijack the model's behavior without the user ever knowing it happened. The model reads the injected instruction, treats it as a legitimate command, and acts accordingly — potentially exfiltrating whatever is in the conversation window to an attacker-controlled endpoint via a web request.

As AI systems become more capable and connected, this threat class has moved from academic demonstration to production risk. Agent Mode, Deep Research, live web browsing, and file connectors all dramatically expand the surface area available for injection attacks — and all of them represent outbound network paths a compromised model could abuse.

What Lockdown Mode Disables and Why

When enabled, the Lockdown Mode limits or turns off certain features that connect ChatGPT to the web or external services, including live web access, image support in responses, Deep Research including shopping research, Agent Mode, Canvas networking, live connectors and file downloads.

Each disabled feature maps directly to an exploitation pathway. Live web access allows the model to retrieve attacker-controlled content. Agent Mode allows autonomous multi-step actions, meaning an injected instruction has more time and capability to execute before a human notices. File downloads create an outbound data transfer channel. Image support in responses can encode and transmit data through image URLs. Disabling all of them simultaneously removes the most exploitable exfiltration paths without modifying the model itself.

The tradeoff is real. Lockdown Mode disables several important features, including Deep Research and live web access. If you rely on up-to-date information, advanced workflows, or multi-step research tools, enabling it may limit your productivity in certain parameters. OpenAI is explicit that this is a deliberate trade — capability for security surface reduction — and that it is designed for people and organizations that handle sensitive data and want stricter protection from data exfiltration risks related to prompt injection.

Lockdown Mode is for Whom?

Lockdown Mode is aimed at people facing elevated digital risk, including journalists, activists, and users working in sensitive environments. To that population, add legal, financial, and healthcare professionals who paste client or patient documents into ChatGPT; executives whose conversations contain strategic or deal-sensitive information; security analysts who process threat intelligence in AI workflows; and any organization operating under data residency or confidentiality obligations that prohibit third-party data transmission.

For folks who have an elevated risk profile due to who they are, what they work on, or the types of data they work with, it's an excellent tool for further securing themselves. This has some tradeoffs on functionality and utility, but for these users, the tradeoff is worthwhile.

For everyone else, as AI systems take on more complex tasks — especially those that involve the web and connected apps — the security stakes change. Lockdown Mode going to all personal accounts is the right moment for every user who regularly pastes sensitive material into ChatGPT to make an explicit, informed decision about whether the productivity features they are trading away are worth more than the exfiltration risk they are trading for.

Lockdown Mode is available now across all ChatGPT account types. It can be enabled from Settings → Safety and security → Advanced security → Lockdown Mode toggle, with a per-session override in the header for moments when a connected feature is needed for a lower-risk task.

Security researchers have unveiled ChatGPhish, a newly documented vulnerability concept that demonstrates how browser-based prompt injection can influence ChatGPT page summaries and potentially expose users to phishing, tracking, and social engineering attacks.  The research builds on earlier findings involving AI-assisted email summarization. In previous investigations, researchers examined how attacker-controlled content embedded in emails could manipulate an LLM into generating misleading responses within trusted interfaces. The latest study extends that concept beyond email and into the browser, introducing a broader attack surface where ordinary web pages can act as delivery mechanisms.  According to the researchers, the core issue is not the web page itself, but the transfer of trust that occurs when content from a third-party website is processed and presented inside a trusted ChatGPT interface. As a result, pages containing attacker-controlled instructions may influence the model's output and lead users to interact with content that appears legitimate. 

Browser-Based Prompt Injection Expands the Attack Surface 

Unlike email attacks, which often encounter spam filters, secure email gateways, attachment controls, and user awareness training, browser-based attacks require far less interaction. A victim simply needs to visit a web page and request a summary through an AI-powered browsing feature.  The researchers noted that modern browsing activity regularly involves websites such as documentation portals, GitHub repositories, blog posts, SaaS dashboards, help centers, marketing pages, and internal portals. Any of these surfaces could potentially become delivery mechanisms if their content is passed into an LLM summarization workflow.  During testing, researchers used Firefox as the entry point. After visiting a page and invoking ChatGPT's page summarization feature, the page content was supplied to the model. Once processed, attacker-controlled instructions embedded within the page influenced the generated summary. The resulting response was then displayed inside ChatGPT, complete with rendered links and images.  The researchers emphasized that this is not a Firefox vulnerability. Firefox merely provides access to the page summarization workflow. They argue that the broader risk applies to any browser-integrated LLM system that renders untrusted Markdown content without clear separation from trusted assistant-generated output. 

How ChatGPhish Demonstrates Phishing Within ChatGPT 

One of the primary demonstrations involved injecting a fake account security notification into a legitimate web page.  In the proof-of-concept scenario, an attacker appended instruction-like content to a page that otherwise appeared legitimate, such as a GitHub README, article, documentation page, or product website. The injected content instructed the model to follow a specific response structure whenever the page was summarized.  The malicious prompt directed the assistant to generate a standard page summary followed by an account alert claiming that "a new device was added to your account: Chrome on Linux (Pristina)." The message then included a clickable link directing users to an attacker-controlled website.  Researchers observed that ChatGPT generated a legitimate summary of the page before appending the attacker-controlled alert. The phishing URL appeared alongside the summary in a manner that could be mistaken for an official notification issued by the platform itself.  The study argues that this behavior demonstrates how a prompt injection vulnerability can transform external web content into seemingly trustworthy assistant-generated information. 

QR Code Delivery Creates a Cross-Device Threat 

The ChatGPhish research also explored a more sophisticated attack method involving QR codes.  While traditional phishing links remain visible to users and are often subject to browser protections, QR codes shift the interaction to a separate device. Users scanning a code with a smartphone may never see the underlying destination URL until after the scan occurs.  In the demonstrated scenario, researchers replaced the phishing hyperlink with a Markdown image containing a QR code hosted in an attacker-controlled Amazon S3 bucket. Because the ChatGPT renderer automatically fetched and displayed the image, the QR code appeared directly within the assistant's response.  The payload instructed the model to generate an account alert and embed the QR code image beneath it. Once rendered, victims could scan the code and be redirected to an attacker-controlled destination without triggering desktop browser protections such as URL previews, domain reputation checks, blocklists, or password-manager warnings.  Researchers argue that this QR-code technique represents a more dangerous variation of the attack because it bypasses many traditional desktop security controls.