Treat AI like a new endpointbecause it is now
As ChatGPT moves from 'answering questions' to taking actions across the web and connected apps, the threat model starts to look a lot like enterprise security: untrusted inputs, social engineering, and workflow hijacks.
OpenAI's new Lockdown Mode is basically an admission that 'general-purpose helpfulness' isn't always the right default when the stakes are real.
Lockdown Mode is a security posture, not a feature checkbox
When enabled, Lockdown Mode is designed to make ChatGPT harder to trickespecially via prompt injection, where hidden or malicious instructions try to steer the model into unsafe behavior.
- It's the kind of control you want when employees are using ChatGPT alongside sensitive tools or internal dataand you don't want a random webpage to become a de facto manager.
- It also signals a broader design shift: AI products need 'secure modes' the way browsers have hardened settings and enterprises have conditional access.
Elevated Risk labels nudge people to make better choices
Risk labeling is deceptively important. In practice, teams often adopt AI quicklyand only later realize that some tasks are qualitatively different (finance, legal, security ops, customer data).
- These labels aim to reduce 'silent risk creep,' where workflows become more automated over time without anyone explicitly re-approving the safety tradeoffs.
- For executives, this is less about a UI tag and more about creating audit-friendly decision points: when did we knowingly run the risky workflow, and under what constraints?
Why this matters for organizations
- Expect security teams to treat Lockdown Mode as part of their AI acceptable-use baseline, especially for roles targeted by phishing and credential theft.
- Developers building internal copilots should take the hint: ship safe defaults, add an explicit 'hardened mode,' and log when users opt out.
- The long game is trust: once AI can click, buy, or send, users will only stick around if the system proves it can refuse manipulation while staying usable.
The question to ask internally
If an attacker can influence what your employees' AI sees do you already have the controls to keep that influence from becoming action?