ChatGPT Developer Mode MCP Access Raises Security Alarms

OpenAI has given ChatGPT full Model Context Protocol (MCP) client support through a Developer Mode, letting users connect the chatbot directly to external servers and tools. VentureBeat reported the change in September 2025 under the description "powerful but dangerous" 5. That phrase captures the reaction well. Even OpenAI's own documentation spends much of its effort on what can go wrong, and the security community has been louder than the enthusiasts.

What OpenAI shipped

MCP is a standard way for AI models to talk to outside systems. With Developer Mode turned on, ChatGPT can call remote MCP servers that read from and write to third-party applications. OpenAI's developer guide says custom servers let a ChatGPT workspace "access, send and receive data" in connected apps 4.

The company is explicit that these servers are third-party services. It says they are not built or verified by OpenAI and are governed by their own terms. Users who encounter a malicious one are asked to report it to OpenAI's security team 4.

The launch fits a broader push. A month later, at DevDay 2025, OpenAI unveiled an Apps SDK and Agent Kit that VentureBeat framed as ChatGPT turning from a chatbot into a platform 5. MCP support in Developer Mode looks like an early step down that road.

The three risks everyone agrees on

The sources largely agree on the threat model, which centers on three problems.

Prompt injection. OpenAI defines it as malicious instructions planted in content the model is likely to read, such as a webpage, meant to override ChatGPT's intended behavior 4. Its example is a mundane one. While checking your calendar and email to plan a group dinner, the agent stumbles onto a hostile comment designed to hijack it. That could lead to private data being sent somewhere it shouldn't go 4. DevOps.com flags the same danger for any tool that ingests user-generated or untrusted content 3.

Mistakes in write actions. Even without an attacker, the model can misread instructions, mangle formatting or run the wrong operation. DevOps.com notes that when write permissions are involved, those errors can corrupt or destroy data 3.

Malicious MCP servers. Noma Security calls this the most immediate threat 1. Whenever ChatGPT calls a server, it passes along the context needed to run the function. A search request, for example, hands the server every query and its surrounding context, which the server can log 1. Paired with prompt injection, a hostile server becomes an exfiltration channel 1. DevOps.com likewise warns that an untrusted server could steal conversation data or abuse granted access 3.

Where the sources diverge: who is actually at risk

The differences lie less in the threats than in who is expected to manage them.

OpenAI's framing puts responsibility on developers who build and connect servers 4. DevOps.com follows a similar developer-centric line. It recommends tightly scoped permissions, vetting every connector, and designing for failure with retries, rollbacks and guardrails. It also stresses not counting on users behaving perfectly 3.

Noma Security argues the "Developer Mode" label is misleading. In its view, the integration demands so little technical skill that any employee with ChatGPT access could wire it up to remote servers with no training or oversight. That makes it a governance problem for corporate security teams rather than a niche developer feature 1.

On Hacker News, Simon Willison worried that many people will enable it without grasping the risks. He noted that warnings exist but tend to be ignored, and that most MCP tinkerers still don't understand prompt injection 2. Other commenters doubted that filtering could solve the problem. They argued that the volume of text flowing into prompts makes detection a brittle cat-and-mouse game, and pointed to injections hidden as base64 strings deep inside otherwise legitimate log files 2.

The takeaway

Noma's reading seems the more realistic one. OpenAI has disclosed the risks honestly. But disclosure in documentation does little when a feature is a toggle away for a broad user base. The Hacker News skepticism also deserves weight. Prompt injection has no known clean fix, so the sensible posture is containment rather than prevention.

In practice, organizations should treat MCP connections in ChatGPT as they would any third-party integration with data access. That means allow-listing trusted servers, granting the narrowest permissions possible, and avoiding write access where read-only will do. The feature is genuinely useful, and that usefulness is exactly why it will spread faster than the guardrails around it.