Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ChatGPT Developer Mode: Full MCP client access

platform.openai.com

Post reply on HN
Print view View original

91–100 of 290 posts

Re: ChatGPT Developer Mode: Full MCP client access

#91

Post by [deleted] »

NikolaNovak wrote: post #73
toomuchtodo wrote: post #45

Earlier quoted context omitted.

I was recently in a call (consulting capacity, subject matter expert) where HR is driving the use of Microsoft Copilot agents, and the HR lead said "You can avoid hallucinations with better prompting; look, use all 8k characters and you'll be fine." Please, proceed. Agree with sibling comment wrt cargo culting and simply ignoring any concerns as it relates to technology limitations.

My problem is the "avoid" keyword: * You can reduce risk of hallucinations with better prompting - sure * You can eliminate risk of hallucinations with better prompting - nope "Avoid" is that intersection where audience will interpret it the way they choose to and then point as their justification. I'm assuming it's not intentional but it couldn't be better picked if it were :-/

[deleted]

Re: ChatGPT Developer Mode: Full MCP client access

#92

Post by simonw »

koakuma-chan wrote: post #51
jonplackett wrote: post #43

Earlier quoted context omitted.

The problem is known as the lethal trifecta. This is an LLM with - access to secret info - accessing untrusted data - with a way to send that data to someone else. Why is this a problem? LLMs don’t have any distinction between what you tell them to do (the prompt) and any other info that goes into them while they think/generate/researcb/use tools. So if you have a tool that reads untrusted things - emails, web pages,…

> LLMs don’t have any distinction between what you tell them to do (the prompt) and any other info that goes into them while they think/generate/researcb/use tools. This is false as you can specify the role of the message FWIW.

Specifying the message role should be considered a suggestion, not a hardened rule.

I've not seen a single example of an LLM that can reliably follow its system prompt against all forms of potential trickery in the non-system prompt.

Solve that and you've pretty much solved prompt injection!

Re: ChatGPT Developer Mode: Full MCP client access

#93

Post by simonw »

koakuma-chan wrote: post #89
jonplackett wrote: post #84

Earlier quoted context omitted.

It doesn’t make much difference. Not enough anyway. In the end all that stuff just becomes context Read some more of you want https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/

It does make a difference and does not become just context. See https://cookbook.openai.com/articles/openai-harmony There is no guarantee that will work 100% of the time, but effectively there is a distinction, and I'm sure model developers will keep improving that.

The lack of a 100% guarantee is entirely the problem.

If you get to 99% that's still a security hole, because an adversarial attacker's entire job is to keep on working at it until they find the 1% attack that slips through.

Imagine if SQL injection of XSS protection failed for 1% or cases.

Re: ChatGPT Developer Mode: Full MCP client access

#94

Post by LelouBil »

ch4s3 wrote: post #82
altruios wrote: post #67

Earlier quoted context omitted.

One-shot prompting: agreed. Using a node based workflow with comfyUI, also being able to draw, also being able to train on your own images in a lora, and effectively using control nets and masks: different story... I see, in the near future, a workflow by artists, where they themselves draw a sketch, with composition information, then use that as a base for 'rendering' the image drawn, with clean up with masking and…

I've tried at least 4 other tools/SAASs and I'm just not seeing it. I've tried training models in other tools with input images, sketches, and long prompts built from other LLMs and the output is usually really bad if you want something even remotely novel. Aside for the terrible name, what does comfyUI add? This[1] all screams AI slop to me. [1] https://www.comfy.org/gallery

It's a node based UI. So you can use multiple models in succession, for parts of the image or include a sketch like the person you're responding to said. You can also add stages to manipulate your prompt.

Basically it's way beyond just "typing a prompt and pressing enter" you control every step of the way

Re: ChatGPT Developer Mode: Full MCP client access

#95

Post by ascorbic »

simonw wrote: post #10

Wow this is dangerous. I wonder how many people are going to turn this on without understanding the full scope of the risks it opens them up to. It comes with plenty of warnings, but we all know how much attention people pay to those. I'm confident that the majority of people messing around with things like MCP still don't fully understand how prompt injection attacks work and why they are such a significant threat.

This doesn't seem much different from Claude's MCP implementation, except it has a lot more warnings and caveats. I haven't managed to actually persuade it to use a tool, so that's one way of making it safe I suppose.

Re: ChatGPT Developer Mode: Full MCP client access

#96

Post by datadrivenangel »

beeflet wrote: post #80
toomuchtodo wrote: post #45

Earlier quoted context omitted.

I was recently in a call (consulting capacity, subject matter expert) where HR is driving the use of Microsoft Copilot agents, and the HR lead said "You can avoid hallucinations with better prompting; look, use all 8k characters and you'll be fine." Please, proceed. Agree with sibling comment wrt cargo culting and simply ignoring any concerns as it relates to technology limitations.

The solution is to sanitize text that goes into the prompt by creating a neural network that can detect prompts

This adds latency and the risk of false positives...

If every MCP response needs to be filtered, then that slows everything down and you end up with a very slow cycle.

Re: ChatGPT Developer Mode: Full MCP client access

#97

Post by albertgoeswoof »

andoando wrote: post #26
CuriouslyC wrote: post #3

I've been waiting for ChatGPT to get MCPs, this is pretty sweet. Next step is a local system control plane MCP to give it sandbox access/permission requests so I can use it as an agent from the web.

Can you give some example of the use cases for MCPs, anything I can add that might be useful to me?

Here’s an example https://contextsync.dev/

Re: ChatGPT Developer Mode: Full MCP client access

#98

Post by Aunche »

simonw wrote: post #27
koakuma-chan wrote: post #18

Earlier quoted context omitted.

> I'm confident that the majority of people messing around with things like MCP still don't fully understand how prompt injection attacks work and why they are such a significant threat. Can you enlighten us?

My best intro is probably this one: https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/ That's the most easily understood form of the attack, but I've written a whole lot more about the prompt injection class of vulnerabilities here: https://simonwillison.net/tags/prompt-injection/

I still don't understand understand. Aren't the risks the exact same for any external facing API? Maybe my imagined use case for MCP servers is different from others.

Re: ChatGPT Developer Mode: Full MCP client access

#99

Post by ripped_britches »

yalogin wrote: post #66

Interestingly all the LLMs and the surrounding industry is doing is automate software engineering tasks. It has not spilled over into other industries at all unlike the smart phone era where lot of consumer facing use cases got solved like Uber, Airbnb etc.. May be I just don't visibility into the other areas and so being naive here. From my position it appears that we are rewriting all the tech stacks to use LLMs.

I would disagree. What industry are you in? It’s being used a ton in medicine, legal, even minerals and mining

You know they have 1b WAU right?

Post reply on HN