Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

ChatGPT Developer Mode: Full MCP client access

platform.openai.com

Post reply on HN
Print view View original

211–220 of 290 posts

Re: ChatGPT Developer Mode: Full MCP client access

#211

Post by CGamesPlay »

simonw wrote: post #205
CGamesPlay wrote: post #201

I don't understand how this is dangerous. Can someone explain how this is different than just connecting the MCP normally and prompting it to use the same tools? I understand that this is just a "slightly more technical" means to access the same tools. What am I missing? Two replies to this comment have failed to address my question. I must be missing something obvious. Does ChatGPT not have any MCP support outside o…

If you have an MCP tool that can perform write actions and you use it in a context where an attacker may be able to sneak their own instructions into the model (classic prompt injection) that attacker can make that MCP tool do anything they want.

How is this "developer mode" different than just connecting the MCP normally and prompt injecting it to use the same tools?

Re: ChatGPT Developer Mode: Full MCP client access

#212

Post by AdieuToLogic »

It's funny.

For decades, the software engineering community writ large has worked to make computing more secure. This has involved both education and significant investments.

Have there been major breaches along the way? Absolutely!

Is there more work to be done to defend against malicious actors? Always!

Have we seen progress over time? I think so.

But in the last few days, both Anthropic[0] and now OpenApi have put offerings into the world which effectively state to the software industry:

  Do you guys think you can stop us from making new
  and unstoppable attack vectors that people will
  gladly install, then blame you and not us when their
  data are held ransom along with their systems being
  riddled with malware?

  Hold my beer...
0 - https://www.anthropic.com/news/claude-for-chrome

Re: ChatGPT Developer Mode: Full MCP client access

#213

Post by AdieuToLogic »

CGamesPlay wrote: post #201

I don't understand how this is dangerous. Can someone explain how this is different than just connecting the MCP normally and prompting it to use the same tools? I understand that this is just a "slightly more technical" means to access the same tools. What am I missing? Two replies to this comment have failed to address my question. I must be missing something obvious. Does ChatGPT not have any MCP support outside o…

> I don't understand how this is dangerous.

From literally the very first sentences in the linked resource:

  ChatGPT developer mode is a beta feature that provides full 
  Model Context Protocol (MCP) client support for all tools, 
  both read and write. It's powerful but dangerous ...

Re: ChatGPT Developer Mode: Full MCP client access

#214

Post by dullcrisp »

int_19h wrote: post #182
ponector wrote: post #158

Earlier quoted context omitted.

The solution is to sanitize text that goes into the prompt by creating a neural network that can detect sarcasm.

Unfortunately it takes ~9 months just to build that network up to the point where you can start training it, and then the training itself is literally years of hard effort.

And sometimes it doesn’t take.

Re: ChatGPT Developer Mode: Full MCP client access

#215

Post by brianjking »

darepublic wrote: post #140
horizion2025 wrote: post #117

Earlier quoted context omitted.

Isn't that just another guardrail that can be bypassed much the same as the guard rails are currently quite easily bypassed? It is not easy to detect a prompt. Note some of the recent prompt injection attack where the injection was a base64 encoded string hidden deep within an otherwise accurate logfile. The LLM, while seeing the Jira ticket with attached trace , as part of the analysis decided to decode the b64 and…

We need the severance code detector

wearing my lumon pin today.

Re: ChatGPT Developer Mode: Full MCP client access

#216

Post by simonw »

CGamesPlay wrote: post #211
simonw wrote: post #205

Earlier quoted context omitted.

If you have an MCP tool that can perform write actions and you use it in a context where an attacker may be able to sneak their own instructions into the model (classic prompt injection) that attacker can make that MCP tool do anything they want.

How is this "developer mode" different than just connecting the MCP normally and prompt injecting it to use the same tools?

It's no different. This just brings that unsafe anti-pattern to the ChatGPT consumer app itself - albeit hidden behind an option with a scary name that might hopefully discourage many users who don't understand the consequences from turning it on.

Re: ChatGPT Developer Mode: Full MCP client access

#218

Post by _kb »

moregrist wrote: post #144
WhitneyLand wrote: post #141

Earlier quoted context omitted.

It’s not that simple. That would result in a brittle solution and/or cat and mouse game. The text that goes into a prompt is vast when you consider common web and document searches are. It’s going to be a long road to good security requiring multiple levels of defense and ongoing solutions.

If only we had a reliable way to detect that a poster was being sarcasm or facetious on the Internet.

Just have the detector always return true. You’ll likely be within acceptable error bounds.

Re: ChatGPT Developer Mode: Full MCP client access

#219

Post by AdieuToLogic »

CGamesPlay wrote: post #201

I don't understand how this is dangerous. Can someone explain how this is different than just connecting the MCP normally and prompting it to use the same tools? I understand that this is just a "slightly more technical" means to access the same tools. What am I missing? Two replies to this comment have failed to address my question. I must be missing something obvious. Does ChatGPT not have any MCP support outside o…

> Two replies to this comment have failed to address my question. I must be missing something obvious.

Since one of these replies is mine, let me clarify.

From the documentation:

  When using developer mode, watch for prompt injections and 
  other risks, model mistakes on write actions that could 
  destroy data, and malicious MCPs that attempt to steal 
  information.
The first warning is equivalent to a SQL injection attack[0].

The second warning is equivalent to promoting untested code into production.

The last warning is equivalent to exposing SSH to the Internet, configured such that your account does not require a password to successfully establish a connection, and then hoping no one can guess your user name.

0 - https://owasp.org/www-community/attacks/SQL_Injection

Post reply on HN