ChatGPT MCP Write Access: Shadow AI Risk Outruns IT Governance

A chat window with production privileges

OpenAI's decision to support the Model Context Protocol (MCP) inside ChatGPT's developer mode was flagged early as "powerful but dangerous." VentureBeat reported in September 2025 that the feature lets developers link external servers directly to ChatGPT 4. Months later, the danger looks less like a theoretical caveat and more like an operational gap that security teams are discovering after the fact.

The scenario Obot lays out is ordinary. An engineer on a paid plan such as Plus turns on developer mode, pastes the URL of an internal MCP server into ChatGPT's connector settings, and starts executing write actions against something like a production CRM 1. ChatGPT does show confirmation prompts before acting. But IT cannot see, audit, or revoke that connection, because it was never routed through anything IT controls 1. Obot's summary is blunt: the confirmation modals exist, and the governance infrastructure does not 1.

Two doors into the same house

Obot distinguishes between two ways ChatGPT reaches MCP-backed tools. The first is a curated apps directory, where OpenAI offers integrations ranging from Notion and Linear to Salesforce Agentforce 1. The second is developer mode, which lets a user point ChatGPT at essentially any MCP server they can reach 1. The first is a vendor-vetted catalog. The second is a self-service backdoor into infrastructure that many companies built for other, more tightly scoped AI clients.

That distinction is why Obot argues the threat model has changed for MCP servers that are already deployed 1. A server designed with the assumption that only sanctioned internal agents would call it now has a widely available consumer-grade client as a potential caller. To close that gap, Obot recommends four prerequisites before enabling the feature: a centralized MCP gateway, an approved server registry, role-based access control at the level of individual tools, and audit logging of every tool call 1. Obot sells MCP infrastructure, so its prescription is not disinterested. Even so, the list maps cleanly onto controls enterprises already expect for any privileged API client.

The platform push behind the risk

The MCP feature fits a broader strategy. At DevDay 2025, OpenAI introduced an Apps SDK and an Agent Kit, which VentureBeat described as turning ChatGPT from a chatbot into a platform, effectively a new app store for interactive apps and autonomous agents 4. The same coverage said Codex had become enterprise-ready, citing a 70% productivity boost and advanced code review 4. Each step widens the set of systems an OpenAI interface can touch and the set of actions it can take on its own.

The coding side shows how fast those agentic workflows are shifting under users' feet. DevOps.com reported that OpenAI cut Codex's context window for GPT-5.6 by 27%. The change appeared in a GitHub pull request to the Codex CLI with little explanation, and developers on Reddit and X began questioning it 2. A smaller window forces the agent to compact, meaning it summarizes or drops earlier history, more often. Every compaction risks losing a decision or constraint that mattered 2. Analysts quoted by the outlet read the cut as a sign that development is moving toward multi-agent workflows 2. More agents passing work among themselves means more autonomous actions, and more need to log and constrain them.

OpenAI also faces real competitive pressure. In a ZDNET survey, 75% of responding developers said they preferred Anthropic's Claude Code over Codex 3. Codex's backers cited more usage for the money without weekly limits, tighter fit with existing ChatGPT workflows, predictable edits that need less cleanup, and the ability to run a full loop of inspecting a repo, changing files, and testing on its own 3. One user, Torus co-founder Anthony Woo, said Claude Code understood the broader codebase better but Codex made more precise, reliable edits 3. These are self-reported perceptions, not benchmarks. Still, they suggest OpenAI has reasons to make its tools as frictionless and capable as possible, and frictionless is the opposite of governed.

The reading

These threads point the same way. OpenAI is expanding what ChatGPT and Codex can do and how easily individuals can wire them into company systems. Enterprise control planes have not kept pace. Developer-mode MCP is the sharpest example, because it combines write access to internal systems with no built-in path for IT oversight 1.

The practical conclusion is that organizations should not rely on ChatGPT's confirmation prompts as a security boundary. They should treat any MCP server reachable from the corporate network as exposed to an unmanaged client. That means putting servers behind a gateway, restricting which tools each identity can call, and logging every call before employees find the developer-mode toggle on their own. Shadow AI has historically meant data leaking out through a chat box. With MCP write access, it can also mean actions flowing in.