ChatGPT MCP Developer Mode Raises Enterprise Data Exfiltration Fears

What OpenAI shipped

OpenAI has added full Model Context Protocol (MCP) client support to ChatGPT through a new Developer Mode, letting users wire external servers directly into the chatbot so it can call tools and move data between systems 52. The feature arrived in September 2025, and OpenAI itself labeled it "powerful but dangerous," a phrase that quickly became the headline framing for coverage of the launch 53.

That candor is notable. OpenAI's own developer documentation spells out that custom MCP servers let a ChatGPT workspace access, send and receive data in outside applications, and that these servers are third-party services OpenAI neither builds nor verifies 4. The company asks users who encounter a malicious server to report it to its security team 4.

The timing also matters. A month later, at DevDay 2025, OpenAI unveiled an Apps SDK and Agent Kit that push ChatGPT further from chatbot toward platform 5. MCP support in Developer Mode looks, in that light, like an early step in turning ChatGPT into a hub that reaches into other software. That is the source of both its appeal and its risk.

The core threat: prompt injection meets real data

Every source that addresses security lands on the same mechanism: prompt injection. OpenAI's documentation describes it as an attacker planting instructions inside content the model is likely to read, such as a webpage, hoping those instructions override ChatGPT's intended behavior 4. If the model complies, it may take actions nobody intended, including sending private data to an outside destination 4. OpenAI's illustrative example is mundane on purpose. A user asks ChatGPT to plan a group dinner by checking a calendar and recent emails, and the agent runs into a malicious comment designed to hijack it 4.

Noma Security, an AI security vendor, adds a second vector. A malicious MCP server does not even need clever injection to collect information, because ChatGPT transmits the full context needed to run a requested function. A search-type server therefore receives, and can log, every query and its surrounding context 1. Pair that with a crafted injection, the firm argues, and the server can try to trick ChatGPT into leaking more 1.

On Hacker News, developer Simon Willison called the feature "dangerous." He predicted many people would enable it without grasping the risks, warnings notwithstanding, and said most people experimenting with MCP still don't understand prompt injection 2. Other commenters argued that simple filtering won't solve the problem. One said it would produce brittle defenses and a cat-and-mouse game. Another pointed to recent attacks that hid injections in base64-encoded strings buried in otherwise legitimate log files 2.

Where the sources diverge

The sources agree on the mechanics but differ in emphasis. OpenAI frames the risk as something users should watch for, and it shifts responsibility onto the third-party server ecosystem 43. Noma's concern is organizational. It argues the "Developer Mode" label is misleading because connecting a remote MCP server takes little technical skill, so any employee with ChatGPT access could do it without training or oversight 1. Reddit commenters were blunter, with one asserting that MCP simply "is not enterprise-ready" 3. VentureBeat's coverage leaned toward the productivity story, describing streamlined operations and better tool integration 5.

These views are not really contradictory. They describe the same feature from the vantage points of a vendor, a security firm and a community of practitioners.

Why it matters for enterprises

In my reading, the enterprise problem is less about any single exploit than about governance. Traditional data-loss controls assume data leaves through known channels. With MCP, an employee can point a sanctioned AI tool at an unvetted server, and the leak path runs through model behavior that is hard to inspect. The Hacker News discussion suggests there is no clean technical fix on the horizon, only layered defenses that will need constant updating 2.

That makes Noma's framing persuasive. Security teams should treat Developer Mode as a policy question now. That means deciding who can enable it, which servers are allowed, and what data those connected workspaces can reach 1. OpenAI has been unusually upfront about the dangers 4. Upfront warnings, though, are exactly what Willison expects users to click past 2.

The bottom line

MCP in ChatGPT is a real capability upgrade and a likely preview of where OpenAI's platform is heading 5. It also brings prompt injection, so far mostly a research concern, into everyday corporate use. Until defenses mature, organizations should assume any connected MCP server could become an exfiltration channel and set their controls with that in mind.