OpenAI kills the chatbot that built it
A senior OpenAI employee told the Financial Times two words this week: “Chat is dead.”
The company is planning the biggest ChatGPT overhaul since its 2022 launch. The chat interface that 400 million monthly users know is getting rebuilt into what OpenAI calls a “superapp.” Think coding tools, AI agents, and partner integrations from companies like Canva and Booking, all wrapped into one product.
Chief Product Officer Thibault Sottiaux laid it out plainly. “It will transcend the actual surface,” he told the FT. “What we’re building towards is where you have your own personal agent that is capable of helping you across everything in your life, be it personally or at work.”
The ChatGPT, Codex, and other product teams have already been merged under Sottiaux. The redesign starts rolling out in the coming weeks on web and mobile. Users will get nudged toward coding tools, image generation, and third-party apps. Over time those nudges fade as the models learn to predict what you need before you ask.
This is not a casual pivot. The numbers tell the story: only about 4% of ChatGPT users pay anything. The people using Codex for software engineering are the ones opening wallets. Business customers already account for roughly 40% of revenue, expected to hit 50% by year end. OpenAI is shifting resources toward enterprise because that is where the money is, and because Anthropic is eating their lunch with corporate clients.
The IPO clock is ticking. Goldman Sachs and Morgan Stanley are finalizing filing paperwork. Both OpenAI and Anthropic are racing to public markets. The superapp rebuild is designed to drive revenue before that listing.
But here is the catch. On the same weekend OpenAI announced its agent future, it also shipped Lockdown Mode, a new security feature that admits prompt injection remains an unsolved problem.
Lockdown Mode does one thing: it blocks ChatGPT from making outbound network requests. No live web browsing. No file downloads. No Deep Research. No Agent Mode. No Canvas networking. Everything gets locked to cached content and local operations.
OpenAI’s own documentation is remarkably candid. “Lockdown Mode does not guarantee data exfiltration cannot happen,” they write. “Risk may remain through enabled Apps, unforeseen combinations of capabilities, or newly discovered techniques.” They call prompt injection a “frontier, challenging research problem” and note that a malicious instruction hidden in an uploaded file “could still affect ChatGPT’s behavior.”
The timing is awkward. Microsoft Threat Intelligence just published research showing how Anthropic’s Claude Code GitHub Action could be tricked into leaking CI/CD secrets through prompt injection. Attackers placed payloads inside HTML comments, invisible to humans but readable by the AI. The Claude Code Read tool was not sandboxed the same way Bash was. Microsoft researchers defeated two defense layers and pulled API keys from system files. Anthropic patched it in version 2.1.128 on May 5.
So OpenAI is building an agent superapp that can book your travel, organize your schedule, and write your code, while simultaneously shipping a mode that disables all the features that make agents useful because it cannot guarantee those agents will not leak your data.
The Decoder called Lockdown Mode what it is: “a band-aid, not a fix for prompt injections.”
The agent era is here. The security to support it is not.