On February 16, 2026, OpenAI introduced two security features to ChatGPT: Lockdown Mode and Elevated Risk labels, aimed at defending against prompt injection and data-exfiltration attacks. OpenAI’s help center documentation and Help Net Security’s coverage point at the same threat model.
Two Defensive Layers by Design
The division of labor is readable straight from the names. Elevated Risk is labeling — making users aware when a situation carries heightened risk. Lockdown Mode is tightening — restricting potentially dangerous behavior when risk runs high. Detection plus restriction is the classic defense-in-depth pattern, now built into the product itself, documented in the help center and shipped with version updates.
Labeling plus lockdown also mirrors how mature security categories evolved. Antivirus shipped detection first and quarantine second; email security shipped spam flags first and sandboxing second. AI assistants are compressing that timeline — both the warning and the response mechanism are arriving within a single product generation.
Why Prompt Injection, Why Now
Prompt injection is the structural threat of the agent era: once a model reads web pages, ingests documents, and connects to data, every piece of external content is a potential instruction carrier — an attacker never needs to touch your account, only to have the model read a hostile string. Once injection succeeds, the common next step is sending data out, which is exactly why exfiltration and injection get defended together. The pairing also tells builders where to put their own controls: at the boundary between untrusted content and model context, and at the boundary between the model and outbound actions.
ChatGPT’s scale makes this more than a technical topic. Shipping one defensive baseline pushes it to the entire user base at once — a platform-level default with far more reach than anything a single enterprise builds for itself.
There is a second-order effect worth naming: baseline security shipped by a platform redefines what counts as reasonable. Once millions of users see risk labels in ChatGPT, enterprise buyers will start asking every assistant vendor for the same affordances — the feature becomes an expectation, and then a procurement checkbox.
What Teams Building Their Own Agents Should Take From It
OpenAI turned defense into a product feature; teams running their own agents have no excuse to lag behind:
- Treat external content as untrusted input, not merely data
- Put explicit confirmation or restriction layers around high-risk actions — outbound transmission, file writes, command execution
- Track the evolution of platform-level defenses and fold it into your own threat model instead of assuming “the model vendor handles it”
February’s race in agent capability — agent teams, long-horizon tasks, edge deployment — expands the attack surface with every release. Lockdown Mode arriving in the same month is the reminder: capability and risk are two faces of the same coin, and defensive cadence has to keep up with release cadence. The uncomfortable corollary: attackers read release notes too. Every defensive mechanism announced publicly doubles as a map of what the vendor fears, so assume injection techniques will adapt around labels and lockdowns — and keep your own layered controls intact regardless of what the platform ships.
Sources
AI-assisted summary compiled from the sources above, reviewed by a human before publishing.