OpenAI Expands ChatGPT Account Security Controls
Summary
OpenAI is expanding Lockdown Mode to limit outbound requests that could enable prompt-injection data exfiltration, and Active Sessions to review and end logins. It also describes Advanced Account Security protections announced earlier.
Key points
- Lockdown Mode is rolling out to personal and self-serve Business accounts and limits outbound network requests to reduce the risk of data exfiltration through prompt injection.
- Lockdown Mode does not prevent prompt injections from appearing in content ChatGPT processes.
- Enabling Lockdown Mode disables or limits features including live web browsing, deep research, agent mode, and file downloads; OpenAI says it is intended for users handling highly sensitive data.
- Active Sessions lets users review signed-in sessions and devices and log out of unfamiliar sessions. It is available across account and workspace types except those linked to organizational SSO.
- Advanced Account Security requires physical security keys or passkeys for sign-in, changes account recovery options, and shortens sign-in sessions.
Article Details
- Event Type
- Rollout of ChatGPT account security controls
- Impact
- OpenAI is making Lockdown Mode more widely available to help limit outbound network requests that could enable data exfiltration through prompt injection; it does not prevent prompt injections from appearing in processed content. Active Sessions lets users review signed-in sessions and devices and log out of unrecognized sessions. These controls add account protection, while Lockdown Mode limits some ChatGPT capabilities and is intended for users handling highly sensitive data.