On June 4, OpenAI officially pushed Lockdown Mode, originally only available to enterprise customers, to personal ChatGPT users. On the surface it's a permission adjustment, but behind it is a paradigm shift in prompt injection defense thinking — no longer hoping the model can identify attacks on its own, but using deterministic mechanisms to hard-cut the "last step" of attacks.
The "Lethal Trifecta" proposed by Simon Willison is the key to understanding this: once an LLM system simultaneously has access to private data, exposure to untrusted content, and a channel to push data out, prompt injection attacks are theoretically always possible. Over the past year or more, security blogs from OpenAI, Anthropic, and Google have repeatedly acknowledged this, yet have never offered an actionable solution.
Lockdown Mode's design directly targets the third leg of the Lethal Trifecta: the exfiltration channel. Through deterministic mechanisms (not relying on AI evaluation), it closes a series of high-risk functions — real-time web browsing is restricted to reading cached content only, images are no longer shown in responses, Deep Research and Agent Mode are directly disabled, Canvas web access and file downloads are shut down, and real-time connectors are frozen. The key is: when OpenAI cannot provide deterministic data-security guarantees on a tool, it simply shuts it off, rather than hoping the model layer makes the right judgment.
The essence of this "security default is off" line of thinking is treating LLM Agents as a new operating system, porting system software paradigms like sandbox and permission control over. For high-risk users handling M&A, source code, and customer sensitive data, Lockdown Mode provides not "protection" but "provable isolation."
A more noteworthy signal is: OpenAI's careful rollout to personal accounts after months on the enterprise side means the demand from high-risk individuals has been validated. It can be foreseen that Anthropic Claude and Google Gemini will launch corresponding "high-security modes" in a similar form in the second half — Lethal Trifecta is the common security ceiling of all LLM Agents. Acknowledging the existence of the ceiling, and bypassing it at the tool layer, is the most pragmatic turn of LLM security in 2026.