OpenAI AgentKit Security Risks: No-Code Agents Widen Attack Surface

What happened

OpenAI's AgentKit, unveiled at DevDay 2025 alongside a new ChatGPT Apps SDK, is part of the company's push to turn ChatGPT from a chatbot into a platform where developers and businesses build interactive apps and autonomous agents 5. Within weeks, AI security firms began publishing analyses arguing that the toolkit's biggest selling point, letting non-programmers assemble capable agents through a visual builder, is also its most significant security liability 23.

The core concern is not a single bug but a structural shift. Zenity Labs and Noma Security both argue that AgentKit moves sensitive business logic out of reviewed code and into drag-and-drop configurations, while connecting those configurations to high-value data and actions 23.

How AgentKit works and where it can break

AgentKit's Agent Builder lets users chain together nodes, including tool nodes that give an agent new abilities 2. Workflows can include conditional logic, loops, guardrails, and user approval gates. Once built, they can be published and handed to a developer to embed in production applications 3.

Zenity highlights two data sources that raise the stakes. The first is File Search, an OpenAI-hosted vector database holding embeddings of user-uploaded files. The second is MCP connectors that can expose Gmail messages, Dropbox files, or Stripe invoices to an agent 2. If an agent with that kind of reach is manipulated, Zenity warns, the result can be private data leaking out or being corrupted 2.

The manipulation vector both firms worry about most is prompt injection. OpenAI's own developer documentation describes the attack plainly: someone plants malicious instructions in content the model is likely to read, such as a webpage, hoping to override intended behavior. That can include sending private data to an external destination 1. OpenAI also notes that custom MCP servers are third-party services it neither builds nor verifies, and it asks users to report malicious ones 1. When ChatGPT's developer mode added MCP support in September, VentureBeat characterized the feature as "powerful but dangerous" 5.

Are the built-in guardrails enough?

AgentKit does ship a Guardrails node that screens inputs for personally identifiable information, jailbreak and prompt-injection attempts, and misuse 2. Zenity's verdict on whether that suffices is a flat no 2. Noma doesn't dispute that the controls exist. Its argument is that the people configuring them often have no security training, and that the workflows they produce, such as expense approval logic, customer support flows, and data access policies, never pass through AppSec review 3.

Noma also places AgentKit's flow agents in a "high-permission, high-functionality" category, so a failure can have a very large blast radius 3.

The sprawl problem

A commentary from NHIMG, built on Noma's research, frames the issue as "agent sprawl." Because AgentKit lowers the barrier to building agents inside an already widely used platform, organizations may soon have many workflows touching data and taking destructive actions without central visibility 4. Its recommendations are practical:

• Inventory every agent workflow before release, recording owner, purpose, connected tools, and data sources.
• Require approval gates for any workflow that can delete data, change permissions, process payments, or run system commands 4.

NHIMG also cites a figure about speed: exposed AWS credentials draw access attempts within about 17 minutes on average, and sometimes in as little as nine 4. That statistic concerns cloud credentials, not AgentKit specifically. Still, it shows how little time defenders have once secrets or access paths leak.

Reading the warnings

The sources agree more than they disagree. OpenAI's documentation acknowledges prompt injection and the risks of third-party MCP servers 1, and the security vendors largely build on those same admitted risks 23. They differ in emphasis. Zenity focuses on technical failure modes and data exposure 2. Noma and NHIMG focus on governance: who builds agents, who reviews them, and who even knows they exist 34.

These warnings come from companies that sell AI agent security products, which is worth keeping in mind. Even so, their central claim holds up without exaggeration. Giving non-developers the power to wire language models to email, files, and payments, then pushing the results into production, recreates the shadow-IT problem with more autonomy attached.

In my reading, AgentKit isn't uniquely dangerous. It speeds up a trend that security teams were already struggling to contain. Enterprises adopting it should treat agent workflows as production code: inventory them, review them, and put a human approval step in front of anything irreversible.