OpenAI AgentKit Security: Guardrails and MCP Mode Draw Scrutiny

What happened

OpenAI spent the autumn of 2025 turning ChatGPT from a chatbot into a platform. In September it added Model Context Protocol (MCP) support to ChatGPT's developer mode, a feature VentureBeat described as "powerful but dangerous." 5 At DevDay in October it followed with the Apps SDK and AgentKit, a toolkit for building autonomous agents that VentureBeat framed as part of ChatGPT becoming "the new app store." 5

Security vendors have since looked closely at both features. Zenity Labs, Noma Security and Obot.ai each published analyses arguing that the controls OpenAI ships are real but incomplete. OpenAI's own help documentation openly acknowledges much of the risk.

The guardrails question

AgentKit's Agent Builder includes a Guardrails node. It checks inputs for personally identifiable information, prompt injection, jailbreak attempts and misuse. 1 Zenity asks whether that is enough to protect a production agent and answers directly: no. 1

Zenity's concern is what these agents can reach. Agents can draw on File Search, an OpenAI-hosted vector store holding embeddings of user-uploaded files that may be highly sensitive. They can also use MCP connectors that expose Gmail messages, Dropbox files and Stripe invoices. 1 The firm flags private data leakage and corruption as a primary failure mode. 1 An input filter sitting at one node cannot account for everything that flows through those connections.

The process problem

Noma's critique is less about any single control and more about who builds agents now. AgentKit gives non-technical users a no-code interface for building flow agents. These agents include conditional logic, loops, guardrails and user-approval gates. 2 A business user can design a workflow and hand it to a developer to embed in an application. 2

Noma's point is that logic such as expense approvals, customer-support flows and data-access policies used to be code that went through application security review. Under AgentKit, it becomes configuration managed by people with no security training, and it ships straight to production. 2 Because these flow agents tend to be high-permission and high-functionality, Noma argues the "blast radius" of a failure is large. 2

MCP in ChatGPT: write access without governance

Obot.ai focuses on ChatGPT's developer mode. Its scenario is concrete. An engineer on a paid Plus plan turns on developer mode and pastes an internal MCP server URL into settings. From there they can run write actions against a production CRM through a chat window that IT cannot see, audit or revoke. 4 Obot stresses that the tool support is not read-only. Creating records, updating databases, modifying files and triggering workflows are all available. 4 Its summary: "The confirmation modals are there. The governance infrastructure is not." 4

OpenAI's documentation largely agrees on the risk. It warns that untrusted MCP servers can increase exposure to prompt injection and tells users to connect only servers they trust. 3 It says ChatGPT may ask for confirmation before write actions depending on permissions, context and potential impact. Some especially risky actions may be blocked outright, and admins see warnings when enabling apps that can modify data. 3 It also says OpenAI red-teams and monitors apps. 3 But it places responsibility for vetting custom and third-party connectors on the customer. 3

Where the sources agree and diverge

All the parties agree that these tools grant real power over real data. OpenAI's own language calls developer mode a capability that "requires responsible setup and oversight." 3 They differ on where the remedy lies:

• OpenAI relies on per-action confirmations, admin warnings and user diligence. 3
• Zenity questions whether built-in guardrails can carry the load. 1
• Noma points to the loss of security review in the development process. 2
• Obot prescribes enterprise infrastructure: a centralized MCP gateway, an approved server registry, tool-level role-based access control, and audit logging of tool calls. 4

The vendors' framing deserves some caution. Each sells products addressing the gaps it describes, so their conclusions point naturally toward their own markets.

Analysis

The vendors' commercial interests do not make the core argument wrong. OpenAI's documentation essentially concedes it by assigning vetting to customers. 3 The likely reading is that OpenAI is shipping platform primitives (guardrail nodes and confirmation prompts) and leaving governance to the enterprise.

That split is common for developer platforms. It is more consequential here because agents act on email, payments and production databases, and because no-code tools put building power in many more hands. 124

For security teams, the practical takeaway is that the risky part of AgentKit and MCP adoption may already be happening without their knowledge. 4 Visibility and policy over which MCP servers and agents are connected probably matter more than any individual guardrail setting.