OpenAI adds Lockdown Mode and Elevated Risk labels to ChatGPT for prompt injection defense

OpenAI introduced Lockdown Mode and Elevated Risk labels for ChatGPT on February 13, 2026. The company said prompt injection has become a particularly important risk as AI systems take on more complex tasks involving the web and connected apps. The new protections are meant to give higher-risk users stronger defenses while making security tradeoffs more visible for everyone else.

Lockdown Mode is an optional advanced security setting for a small set of highly security-conscious users, such as executives or security teams at prominent organizations. In this mode, certain tools and capabilities are deterministically disabled, and web browsing is restricted to cached content so no live network requests leave OpenAI's controlled network. OpenAI says that design is intended to reduce prompt injection-based data exfiltration risk.

• Lockdown Mode is available for ChatGPT Enterprise, ChatGPT Edu, ChatGPT for Healthcare, and ChatGPT for Teachers
• Workspace admins can enable it through role-based controls
• Admins retain granular control over which apps and app actions remain available
• Elevated Risk labels are being standardized across ChatGPT, ChatGPT Atlas, and Codex

The Elevated Risk label is also important because it changes how OpenAI communicates risk inside the product. The company gave Codex network access as an example: users can see directly in settings what changes when internet access is enabled, what new risks are introduced, and when that level of access makes sense. That reflects a broader shift in AI product design from hiding complexity toward exposing the operational consequences of connected features.

The announcement matters because it treats AI safety as a product architecture and enterprise controls problem, not only a model behavior problem. OpenAI said it plans to bring Lockdown Mode to consumers in the coming months, but the feature is launching first in enterprise-oriented environments. The next question is whether deterministic controls like these materially reduce real prompt injection incidents and whether competitors adopt similar patterns.