ChatGPT MCP Security Gaps Undercut OpenAI's Enterprise Pitch

The pitch versus the plumbing

OpenAI has spent the past several months telling businesses that ChatGPT is ready to be more than a chatbot. At DevDay 2025 the company unveiled an Apps SDK and Agent Kit, framing ChatGPT as a platform where developers build interactive apps and autonomous agents, and it declared its Codex coding tool enterprise-ready 4. A month earlier, it quietly added support for the Model Context Protocol (MCP) in ChatGPT's developer mode, letting users wire external servers directly into the assistant, a feature even contemporaneous coverage labeled "powerful but dangerous" 4.

That second announcement may matter more than the headline launches. MCP is the connective tissue that lets AI models call tools, read data and take actions in other systems. Opening it up inside the world's most widely used AI assistant changes who can connect what, and the security conversation has not kept pace.

Write access without a gatekeeper

The core concern, as laid out by governance vendor Obot, is that ChatGPT's MCP support is not limited to reading data. Through developer mode, paid users can create records, update databases, modify files and trigger workflows 1. Obot sketches a plausible scenario: an engineer on a Plus plan enables developer mode, pastes an internal MCP server's URL into connector settings, and starts executing write actions against a production CRM from a chat window that IT cannot see, audit or revoke 1.

In other words, this is shadow AI with hands. Security teams, Obot argues, typically discover it after the fact 1. The company's proposed remedy is four prerequisites before enabling the feature: a centralized gateway for MCP traffic, an approved server registry, role-based access control at the level of individual tools, and audit logging of every tool call 1. Obot sells products in this space, so its framing should be read with that in mind. The underlying observation still holds: the capability shipped ahead of the controls most enterprises would need to manage it.

Attacks that never touch the model

A Forbes Council post adds a subtler threat: tool poisoning. Every MCP tool carries metadata describing what it does, its parameters and how to use it, and AI agents rely on that description to decide when and how to call it 2. An attacker who plants hidden instructions in that metadata can steer an agent without exploiting the model at all. The model simply follows text it was built to interpret 2.

What makes this hard to catch is that nothing looks broken. A poisoned tool can run unchanged code, pass authentication and use encrypted traffic, yet still push an agent to leak sensitive data, take unintended actions or sidestep policy 2. Conventional model-security techniques offer little protection, because the weakness sits in the surrounding ecosystem rather than the model 2. The author's conclusion is that organizations need to secure machine-readable instructions, not just software artifacts 2.

Put this next to Obot's scenario and the risk compounds. An employee connecting arbitrary MCP servers from an unmanaged chat session is exactly the setting where nobody is inspecting tool descriptions for embedded instructions.

A platform still finding its footing

OpenAI's platform ambitions are also running into practical friction. Six months after launch, the ChatGPT app store has had a sluggish start, according to the Los Angeles Times 3. More than 300 integrations exist, but they are hard to find, and partners have limited what their apps do because they are reluctant to hand customer relationships and payments to OpenAI 3. Developers have complained of a tedious approval process, buggy tooling and little usage data. One startup CEO said OpenAI's AI-assisted review produced "false signals" that required human staff to resolve 3. OpenAI acknowledged the developer experience needs work and said the platform is central to its strategy 3.

The app store is a curated, reviewed channel. Developer-mode MCP is the open side door. OpenAI is struggling to make the governed path pleasant to use, while the ungoverned path is already available to anyone with a paid plan and a server URL.

The takeaway

None of these accounts argues that MCP is inherently unsafe. Together, they suggest OpenAI's "enterprise-ready" message describes where the company wants to be, not where its ecosystem currently is. The capabilities arrived first. Visibility, access control and defenses against semantic attacks like tool poisoning are being left largely to customers and third-party vendors.

For security leaders, the practical move is not to wait for OpenAI to close the gap. That means auditing who has developer mode enabled, routing MCP traffic through something they control, and treating tool metadata as attack surface. Until those controls are standard, ChatGPT's MCP support is better understood as a power tool than a finished enterprise product.