Significantly reduces the risk of corporate data leaks when using AI to process sensitive company files or customer data.
What did OpenAI just launch?
OpenAI launched Lockdown Mode to stop data exfiltration. It blocks the AI from sending private information to external, unauthorized websites. The feature is available for Free, Plus, Pro, and Business accounts. This removes the primary vector for data theft via prompt injection without adding a single dollar to the monthly bill.
Is Lockdown Mode actually effective against prompt injections?
Simon Willison identifies this as a deterministic mechanism to block outbound requests. It stops the attack cycle by preventing the AI from communicating with malicious external servers. The Hype Score of 7.2 reflects the rarity of a production-ready security fix for this specific vulnerability. True security comes from hard constraints, and this mechanism shifts the defense from hopeful prompting to actual infrastructure blocking.
Should small business owners care about data exfiltration?
Businesses processing sensitive customer data face massive legal and financial liabilities. A single leaked file via a prompt injection can terminate a client contract instantly. This tool is included in all existing tiers at no additional cost. The cost of ignoring this setting is a potential data breach that no insurance policy fully covers. We’ve flagged similar zero-cost security wins in the AI Profit Wire signals before, and the pattern holds: the easiest improvements in AI security are usually the toggles most operators haven’t enabled yet.
I’m staring at a vendor contract that promises data security, but the actual implementation is usually just a prayer and a prompt. You feed a customer’s PII into a model to summarize a transcript and you’re betting your entire reputation on a system that has no hard walls. Most business owners assume the Enterprise label is a shield, but the real protection is a deterministic block that prevents data from leaving the room.
Should you act on this signal now?
Enable Lockdown Mode across all corporate accounts today. This is a zero-cost implementation that provides immediate risk reduction for any business using AI to process internal files. There is no downside to enabling a deterministic block on unauthorized outbound requests. Enable Lockdown Mode for every user account to eliminate the risk of prompt injection leaks before the next production run.
Source: simonwillison.net
