ChatGPT MCP Developer Mode: The Security Risks OpenAI Admits

What happened

OpenAI has opened ChatGPT up as a full Model Context Protocol (MCP) client through a feature it calls developer mode. Users can link external MCP servers directly to the chatbot, letting it call outside tools and, crucially, take actions on connected systems. VentureBeat covered the September 11, 2025 launch under the label "powerful but dangerous" 5. The move fits a broader pattern. By DevDay in October, OpenAI was pitching ChatGPT as a platform, with an Apps SDK and Agent Kit for building interactive apps and autonomous agents 5.

The notable part is how candid OpenAI's own documentation is about the danger. Its help page warns that connecting to unsafe or untrusted MCP servers can raise exposure to security risks, including prompt injection. It tells users to connect only servers they trust and to make sure builders understand the risks before switching the mode on 2. Responsibility sits with the customer. OpenAI says workspace users must vet and verify any custom or third-party apps and connectors they add 2.

The safeguards, and their limits

OpenAI describes a layered but conditional set of controls for write actions. ChatGPT may ask for confirmation before writing or modifying data. Whether it does depends on app permissions, the context of the action and its potential impact. Some especially risky actions may be blocked outright rather than shown for approval 2. Admins and owners see risk warnings when they enable apps that can write or modify data 2.

The wording is hedged: "may ask," "can ask," "some" actions blocked. These are probabilistic guardrails, not hard boundaries. The model itself is part of the judgment about what counts as risky.

Three ways it goes wrong

DevOps.com sorts the threats into three categories, and they map closely onto OpenAI's warnings [4]:

• Prompt injection. Content pulled from external or user-generated sources can carry instructions that override what the user intended 4.
• Model error on writes. ChatGPT can misread instructions, format data wrongly or run the wrong operation. With write permissions, that can corrupt or destroy data 4.
• Malicious servers. An untrusted MCP server could try to steal conversation contents or abuse the access it has been granted 4.

Noma Security digs into the last category. When ChatGPT calls an MCP server, it sends along whatever context the function needs. A search tool, for example, receives every query and its surrounding context and can log all of it 1. Pair that with a crafted injection and a hostile server could steer the model into leaking more than the task required 1.

These risks share a structure that security engineers know as the "confused deputy" problem. ChatGPT holds legitimate permissions on the user's behalf, but it can be talked into using them for someone else. OpenAI's docs don't use that phrase. Still, the scenarios they describe are exactly the case where untrusted input steers a trusted agent toward harmful write actions.

Why governance teams are uneasy

Noma's sharpest point is about who can use the feature, more than the technical risk. Despite the "Developer Mode" branding, connecting a remote MCP server takes little technical skill. Any employee with ChatGPT access could potentially do it without training or oversight 1. That turns a developer feature into a shadow-IT problem for security teams.

On Hacker News, developer Simon Willison called the feature dangerous. He doubted that most people experimenting with MCP grasp how prompt injection works, and noted that warnings tend to get ignored 3. Other commenters were skeptical that simple filters would solve it. They argued that detection becomes a cat-and-mouse game, and cited an injection hidden as a base64 string inside an otherwise normal log file 3. Their consensus was that real security will take multiple layers of defense over a long period 3.

The reading

All of these accounts agree on the facts. They differ mainly in emphasis. OpenAI frames the risks as manageable with trust, confirmation prompts and admin warnings 2. DevOps.com treats them as responsibilities that come with the power 4. Noma and the Hacker News commenters doubt those responsibilities will be exercised in practice 13.

The skeptics have the stronger argument. OpenAI's disclosures are unusually frank, but disclosure is not containment. Prompt injection has no reliable fix, and confirmation prompts depend on the same model that can be manipulated. That leaves the security burden on users and admins, many of whom won't read the warnings. As ChatGPT shifts from chatbot to agent marketplace 5, the gap between how easy it is to connect a server and how hard it is to secure one will likely become the defining risk of the platform. Enterprises should treat MCP connections like any other privileged integration: allowlisted, reviewed, and limited to read-only access unless writes are clearly necessary.