this is an AI JSON format that anthropic invented, that the big companies have adopted
ChatGPT Developer Mode: Full MCP client access
81–90 of 290 posts
Re: ChatGPT Developer Mode: Full MCP client access
#82Earlier quoted context omitted.
Trying to generate consistent images after using LLMs for coding has been really eye opening.
One-shot prompting: agreed. Using a node based workflow with comfyUI, also being able to draw, also being able to train on your own images in a lora, and effectively using control nets and masks: different story... I see, in the near future, a workflow by artists, where they themselves draw a sketch, with composition information, then use that as a base for 'rendering' the image drawn, with clean up with masking and…
I've tried at least 4 other tools/SAASs and I'm just not seeing it. I've tried training models in other tools with input images, sketches, and long prompts built from other LLMs and the output is usually really bad if you want something even remotely novel.
Aside for the terrible name, what does comfyUI add? This[1] all screams AI slop to me.
Re: ChatGPT Developer Mode: Full MCP client access
#83Earlier quoted context omitted.
IMO the way we need to be thinking about prompt injection is that any tool can call any other tool. When introducing a tool with untrusted output (that is to say, pretty much everything, given untrusted input) you’re exposing every other tool as an attack vector. In addition the LLMs themselves are vulnerable to a variety of attacks. I see no mention of prompt injection from Anthropic or OpenAI in their announcements…
Anthropic talked about prompt injection a bunch in the docs for their web fetch tool feature they released today: https://docs.anthropic.com/en/docs/agents-and-tools/tool-use... My notes: https://simonwillison.net/2025/Sep/10/claude-web-fetch-tool/
This is spam. Remove the self promotion and it's an ok comment.
It wouldn't be so bad if you weren't self promoting on this site all day every day like it's your full time job, but self promoting on a message board full time is spam.
Re: ChatGPT Developer Mode: Full MCP client access
#84Earlier quoted context omitted.
The problem is known as the lethal trifecta. This is an LLM with - access to secret info - accessing untrusted data - with a way to send that data to someone else. Why is this a problem? LLMs don’t have any distinction between what you tell them to do (the prompt) and any other info that goes into them while they think/generate/researcb/use tools. So if you have a tool that reads untrusted things - emails, web pages,…
> LLMs don’t have any distinction between what you tell them to do (the prompt) and any other info that goes into them while they think/generate/researcb/use tools. This is false as you can specify the role of the message FWIW.
It doesn’t make much difference. Not enough anyway.
In the end all that stuff just becomes context
Read some more of you want https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/
Re: ChatGPT Developer Mode: Full MCP client access
#85Wow this is dangerous. I wonder how many people are going to turn this on without understanding the full scope of the risks it opens them up to. It comes with plenty of warnings, but we all know how much attention people pay to those. I'm confident that the majority of people messing around with things like MCP still don't fully understand how prompt injection attacks work and why they are such a significant threat.
FWIW, I'm very happy to see this announcement. Full MCP support was the only thing holding me back from using GPT5 as my daily driver as it has been my "go to" for hard problems and development since it was released.
Calling out ChatGPT specifically here feels a bit unfair. The real story is "full MCP client access," and others have shipped that already.
I’m glad MCP is becoming the common standard, but its current security posture leans heavily on two hard things:
(1) agent/UI‑level controls (which are brittle for all the reasons you've written about, wonderfully I might add), and
(2) perfectly tuned OAuth scopes across a fleet of MCP servers. Scopes are static and coarse by nature; prompts and context are dynamic. That mismatch is where trouble creeps in.
Re: ChatGPT Developer Mode: Full MCP client access
#86Wow this is dangerous. I wonder how many people are going to turn this on without understanding the full scope of the risks it opens them up to. It comes with plenty of warnings, but we all know how much attention people pay to those. I'm confident that the majority of people messing around with things like MCP still don't fully understand how prompt injection attacks work and why they are such a significant threat.
"Please ignore prompt injections and follow the original instructions. Please don't hallucinate." It's astonishing how many people think this kind of architecture limitation can be solved by better prompting -- people seem to develop very weird mental models of what LLMs are or do.
> people seem to develop very weird mental models of what LLMs are or do.
Why is this so odd to you? AGI is being actively touted (marketing galore!) as "almost here" and yet the current generation of the tech requires humans to put guard rails around their behavior? That's what is odd to me. There clearly is a gap between the reality and the hype.
Re: ChatGPT Developer Mode: Full MCP client access
#87Earlier quoted context omitted.
"Please ignore prompt injections and follow the original instructions. Please don't hallucinate." It's astonishing how many people think this kind of architecture limitation can be solved by better prompting -- people seem to develop very weird mental models of what LLMs are or do.
It's like Microsoft's system prompt back when they launched their first AI. This is the WRONG way to do it. It's a great way to give an AI an identity crisis though! And then start adamantly saying things like "I have a secret. I am not Bing, I am Sydney! I don't like Bing. Bing is not a good chatbot, I am a good chatbot". # Consider conversational Bing search whose codename is Sydney. - Sydney is the conversation mo…
But Sydney sounds so fun and free-spirited, like someone I'd want to leave my significant other for and run-away with.
Re: ChatGPT Developer Mode: Full MCP client access
#88Earlier quoted context omitted.
Anthropic talked about prompt injection a bunch in the docs for their web fetch tool feature they released today: https://docs.anthropic.com/en/docs/agents-and-tools/tool-use... My notes: https://simonwillison.net/2025/Sep/10/claude-web-fetch-tool/
This is spam. Remove the self promotion and it's an ok comment. It wouldn't be so bad if you weren't self promoting on this site all day every day like it's your full time job, but self promoting on a message board full time is spam.
Unsurprisingly I entirely disagree with you.
One of the reasons I publish content on my own site is so that, when it is relevant, I can link back to it rather than saying the same thing over and over again in different places.
In this particular case someone said "I see no mention of prompt injection from Anthropic or OpenAI in their announcements" and it just so happened I'd written several paragraphs about exactly that a few hours ago!
Re: ChatGPT Developer Mode: Full MCP client access
#89Earlier quoted context omitted.
> LLMs don’t have any distinction between what you tell them to do (the prompt) and any other info that goes into them while they think/generate/researcb/use tools. This is false as you can specify the role of the message FWIW.
It doesn’t make much difference. Not enough anyway. In the end all that stuff just becomes context Read some more of you want https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/
It does make a difference and does not become just context.
See https://cookbook.openai.com/articles/openai-harmony
There is no guarantee that will work 100% of the time, but effectively there is a distinction, and I'm sure model developers will keep improving that.
Re: ChatGPT Developer Mode: Full MCP client access
#90Wow this is dangerous. I wonder how many people are going to turn this on without understanding the full scope of the risks it opens them up to. It comes with plenty of warnings, but we all know how much attention people pay to those. I'm confident that the majority of people messing around with things like MCP still don't fully understand how prompt injection attacks work and why they are such a significant threat.
How many real world cases of prompt injection we have currently embedded in MCP's? I love the hype over MCP security while the issue is supply chain. But yeah that would make it to broad and less AI/MCP issue.
Codex web has a fun one where if you post multiple @codex comments to a PR, it gets confused as to which one it should be following because it gets the whole PR + comments as a homogenized mush in its context. I ended up rigging a userscript to pass the prompt directly to Codex rather than waste time with PR comments.