> Eligibility: Available in beta to Pro and Plus accounts on the web. But not Team?
I don't see it in Team.
ChatGPT Developer Mode: Full MCP client access
111–120 of 290 posts
Re: ChatGPT Developer Mode: Full MCP client access
#112Wow this is dangerous. I wonder how many people are going to turn this on without understanding the full scope of the risks it opens them up to. It comes with plenty of warnings, but we all know how much attention people pay to those. I'm confident that the majority of people messing around with things like MCP still don't fully understand how prompt injection attacks work and why they are such a significant threat.
I have prompt-injected myself before by having a model accidentally read a stored library of prompts and get totally confused by it. It took me a hot minute to trace, and that was a 'friendly' accident.
I can think of a few NPM libraries where an embedded prompt could do a lot of damage for future iterations.
Re: ChatGPT Developer Mode: Full MCP client access
#113ok, gonna create a remote MCP that can make GET, POST and PUT requests - cause thats what i actually need my gpt to do, real internet access
Re: ChatGPT Developer Mode: Full MCP client access
#114Is the focus on how dangerous mcp capabilities are a way to legitimize why they have been slow to adopt the mcp protocol? Or that they have internally scrapped their own response and finally caved to something that ideally would be a more security focused standard?
Re: ChatGPT Developer Mode: Full MCP client access
#115Earlier quoted context omitted.
> people seem to develop very weird mental models of what LLMs are or do. Maybe because the industry keeps calling it "AI" and throwing in terms like temperature and hallucination to anthropomorphize the product rather than say Randomness or Defect/Bug/ Critical software failures. Years ago I had a boss who had one of those electric bug zapping tennis racket looking things on his desk. I had never seen one before, it…
> another staff members, who was in fact in sales, walked up, zapped himself, then did it two more times before putting it down. It’s important to verify reproducibility.
That sales person was also scientist.
Re: ChatGPT Developer Mode: Full MCP client access
#116OpenAI should probably consider:
- enabling local MCP in Desktop like Claude Desktop, not just server-side remote. (I don't think you can run a local server unless you expose it to their IP)
- having an MCP store where you can click on e.g. Figma to connect your account and start talking to it
- letting you easily connect to your own Agents SDK MCP servers deployed in their cloud
ChatGPT MCP support is underwhelming compared to Claude Desktop.
Re: ChatGPT Developer Mode: Full MCP client access
#117Earlier quoted context omitted.
I was recently in a call (consulting capacity, subject matter expert) where HR is driving the use of Microsoft Copilot agents, and the HR lead said "You can avoid hallucinations with better prompting; look, use all 8k characters and you'll be fine." Please, proceed. Agree with sibling comment wrt cargo culting and simply ignoring any concerns as it relates to technology limitations.
The solution is to sanitize text that goes into the prompt by creating a neural network that can detect prompts
Isn't that just another guardrail that can be bypassed much the same as the guard rails are currently quite easily bypassed? It is not easy to detect a prompt. Note some of the recent prompt injection attack where the injection was a base64 encoded string hidden deep within an otherwise accurate logfile. The LLM, while seeing the Jira ticket with attached trace , as part of the analysis decided to decode the b64 and was led a stray by the resulting prompt. Of course a hypothetical LLM could try and detect such prompts but it seems they would have to be as intelligent as the target LLM anyway and thereby subject to prompt injections too.
Re: ChatGPT Developer Mode: Full MCP client access
#118Earlier quoted context omitted.
I was recently in a call (consulting capacity, subject matter expert) where HR is driving the use of Microsoft Copilot agents, and the HR lead said "You can avoid hallucinations with better prompting; look, use all 8k characters and you'll be fine." Please, proceed. Agree with sibling comment wrt cargo culting and simply ignoring any concerns as it relates to technology limitations.
My problem is the "avoid" keyword: * You can reduce risk of hallucinations with better prompting - sure * You can eliminate risk of hallucinations with better prompting - nope "Avoid" is that intersection where audience will interpret it the way they choose to and then point as their justification. I'm assuming it's not intentional but it couldn't be better picked if it were :-/
Essentially a motte-and-bailey. "mitigate" is the same. Can be used when the risk is only partially eliminated but you can be lucky (depending on perspective) the reader will believe the issue is fully solved by that mitigation.
Re: ChatGPT Developer Mode: Full MCP client access
#119Earlier quoted context omitted.
My best intro is probably this one: https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/ That's the most easily understood form of the attack, but I've written a whole lot more about the prompt injection class of vulnerabilities here: https://simonwillison.net/tags/prompt-injection/
I still don't understand understand. Aren't the risks the exact same for any external facing API? Maybe my imagined use case for MCP servers is different from others.
Imagine running an MCP server inside your network that grants you access to some internal databases. You might expect this to be safe but once you connect that internal MCP server to an AI agent all bets are off. It could be something as simple as the AI agent offering to search the Internet but being convinced to embed information provided from your internal MCP server into the search query for a public (or adversarial service). That's just the tip of the iceberg here...
Re: ChatGPT Developer Mode: Full MCP client access
#120Earlier quoted context omitted.
My problem is the "avoid" keyword: * You can reduce risk of hallucinations with better prompting - sure * You can eliminate risk of hallucinations with better prompting - nope "Avoid" is that intersection where audience will interpret it the way they choose to and then point as their justification. I'm assuming it's not intentional but it couldn't be better picked if it were :-/
Essentially a motte-and-bailey. "mitigate" is the same. Can be used when the risk is only partially eliminated but you can be lucky (depending on perspective) the reader will believe the issue is fully solved by that mitigation.
TIL. Thanks for sharing.