New ChatGPT Lockdown Mode targets prompt injection risks

OpenAI has announced Lockdown Mode, a new security feature designed for individuals and organizations that handle sensitive data. The company states that the feature will provide additional protection from prompt injection attacks. On first reference, a prompt injection refers to malicious chatbot instructions hidden in web pages or other content sources. These attacks can manipulate the chatbot’s behavior or lead to unauthorized data sharing, making security a critical concern for enterprise users.

According to OpenAI, Lockdown Mode is not intended for everyone. Instead, the company notes that the feature is built for specific use cases. “It is designed for people and organizations that handle sensitive data and want stricter protection from data exfiltration risks related to prompt injection,” OpenAI stated. To address these specific security needs, the company says it is currently rolling Lockdown Mode out to self-serve ChatGPT Business accounts, as well as eligible personal accounts.

When enabled, Lockdown Mode will disable several key features of the ChatGPT service to reduce these security risks. Specifically, the mode will disable:

• Live web browsing, meaning users can only access cached content
• The retrieval and display of images from the web, though users can still generate images
• Deep research
• Agent mode

By disabling these features, the mode is designed to reduce the likelihood that sensitive data gets shared during a prompt injection attack.

However, OpenAI cautions that ChatGPT could still be vulnerable to prompt injections even with Lockdown Mode turned on. The company notes that malicious instructions could appear in cached web content or in an uploaded file, and could still affect the behavior or accuracy of a response. This means that while the feature restricts certain capabilities to lower the risk of data exfiltration, it does not completely eliminate the threat of prompt injections.

Why it matters

OpenAI is introducing Lockdown Mode to reduce the likelihood of sensitive data being shared during prompt injection attacks, though the company notes that the feature does not eliminate all vulnerabilities. This highlights the ongoing challenge of securing large language models when they interact with untrusted external data.