Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Lockdown Mode

help.openai.com

Post reply on HN
Print view View original

11–20 of 39 posts

Re: Lockdown Mode

#11

Post by dnnddidiej »

altmanaltman wrote: post #10
dnnddidiej wrote: post #8

Earlier quoted context omitted.

We can seperate them but the $ value of an agent that does is much lower than one that doesn't. As a pre LLM analogy imagine working at a bank with a whitelist firewall. You need to install a package but requires an IT ticket. Safer but slooooower. Now not saying what the answer here is but that is the issue. The answer may be more like industries that get safer through lessons (like aviation) rather than go for 100%…

what? Aviation safety is not designed to get safer through lessons? They literally try to ensure it is 100% safe out of the gate. The accidents that happen are usually statistical outliers and lead to loss of life. That's what it means when they say aviation regulations are written in blood. Not that they just fling planes into the sky and be like "boy i hope we learn some new regulations from this". The number of ai…

I think we agree? Unless my reading comp is off today.

Re: Lockdown Mode

#12

Post by mapontosevenths »

kijin wrote: post #5

So we still don't have a reliable way to separate instructions from data when talking to an LLM, a problem that humans learned how to solve decades ago in areas like SQL and memory safety. But hey, we have these hopefully-not-leaky containers, which are probably implemented with just more system prompts. How long until somebody figures out how to trick Codex into disabling Lockdown Mode for you?

> So we still don't have a reliable way to separate instructions from data when talking to an LLM

Humans also do not know how to do this reliably, which is why phishing is still a thing and always will be.

Re: Lockdown Mode

#13

Post by simonw »

On the one hand this is exactly the right solution to prevent lethal trifecta exfiltration attacks.

The existence of lockdown mode does however imply that ChatGPT, in its default settings, does not provide robust protection against sufficiently determined data exfiltration attacks!

Re: Lockdown Mode

#15

Post by Smaug123 »

mapontosevenths wrote: post #12
kijin wrote: post #5

So we still don't have a reliable way to separate instructions from data when talking to an LLM, a problem that humans learned how to solve decades ago in areas like SQL and memory safety. But hey, we have these hopefully-not-leaky containers, which are probably implemented with just more system prompts. How long until somebody figures out how to trick Codex into disabling Lockdown Mode for you?

> So we still don't have a reliable way to separate instructions from data when talking to an LLM Humans also do not know how to do this reliably, which is why phishing is still a thing and always will be.

I think the Stroop effect ("read these colour names, each written in a different colour") is probably the purest demonstration of this. Humans are trivially prompt-injectable.

Re: Lockdown Mode

#16

Post by berlianta »

simonw wrote: post #13

On the one hand this is exactly the right solution to prevent lethal trifecta exfiltration attacks. The existence of lockdown mode does however imply that ChatGPT, in its default settings, does not provide robust protection against sufficiently determined data exfiltration attacks!

Related: Simon Willison’s post on OpenAI’s new Lockdown Mode (he coined the “lethal trifecta” term this is based on): https://simonwillison.net/2026/Jun/5/openai-help-lockdown-mo...

Re: Lockdown Mode

#17

Post by zerobees »

"Prompt injection is not currently a major risk, but its impact could grow as attackers develop more sophisticated methods." - that's such a weird statement to make. It's one of the most significant factors limiting the adoption of the technology in business.

I have mixed feelings about this feature. We're playing with tech that's supposed to do human-shaped things but can't be trusted nearly as much as a human employee (and can't be held responsible for what it does). Restricting the tools available to that patently untrustworthy entity doesn't solve the problem, it just makes the entity less useful, forcing you to sooner or later let it out of the jail.

Re: Lockdown Mode

#18

Post by jameshart »

berlianta wrote: post #16
simonw wrote: post #13

On the one hand this is exactly the right solution to prevent lethal trifecta exfiltration attacks. The existence of lockdown mode does however imply that ChatGPT, in its default settings, does not provide robust protection against sufficiently determined data exfiltration attacks!

Related: Simon Willison’s post on OpenAI’s new Lockdown Mode (he coined the “lethal trifecta” term this is based on): https://simonwillison.net/2026/Jun/5/openai-help-lockdown-mo...

Related: simonw is Simon Willison

Re: Lockdown Mode

#20

Post by berlianta »

jameshart wrote: post #18
berlianta wrote: post #16

Earlier quoted context omitted.

Related: Simon Willison’s post on OpenAI’s new Lockdown Mode (he coined the “lethal trifecta” term this is based on): https://simonwillison.net/2026/Jun/5/openai-help-lockdown-mo...

Related: simonw is Simon Willison

Yeah I know the source references him (replying to his comment), that's exactly why I'm giving credit where it's due
Post reply on HN