ChatGPT Work Just Wired an AI Agent Into Your Company's Apps. Who's in Charge?

#ai #productivity #agents #chatgpt

On July 9, 2026, OpenAI shipped ChatGPT Work — an autonomous AI agent powered by GPT-5.6 that can access local files, connected apps, email, calendar, and your browser. It runs multi-step projects in the background for hours via Scheduled Tasks, and its Ultra mode coordinates four agents in parallel across workstreams. Pro, Enterprise, and Edu accounts activated within hours of the announcement. By the time your security team reviewed the release notes, employees were already connecting it to Salesforce, Gmail, and shared drives.

ChatGPT Work is not a chatbot upgrade. It's an autonomous agent wired into your company's tool stack, capable of reading, writing, and acting across systems without pausing for human review. OpenAI's own release guidance is direct: "Local files, email, CRM data, and browser control increase the blast radius of a mistake." The company tells teams to "require approval for external messages, deletions, purchases, account changes, and sensitive data transfers." Good advice. But no native enforcement layer ships with ChatGPT Work to implement it.

That gap is what this post is about.

What ChatGPT Work Can Actually Do

ChatGPT Work wraps GPT-5.6's agent capabilities inside Codex's execution system. The practical workflow: give Work a goal and the source systems it may use; let it propose or begin a plan; it works across files and apps in parallel, then returns finished material — a document, a spreadsheet, an updated CRM record, a slide deck — instead of another block of text.

OpenAI's announced use cases include reviewing thousands of leads, tracing broken follow-ups across CRM and email, checking launch plans against Jira and go-to-market schedules, and automating conference preparation. ChatGPT Work's Ultra configuration coordinates four agents by default, routing subtasks across parallel workstreams. CEO Sam Altman told CNBC that GPT-5.6 Sol is "54% more token efficient on agentic coding" — which matters, because agentic work multiplies token usage fast. One task can branch into research, file analysis, tool calls, subagents, verification, and several rounds of revision.

That is exactly what makes it powerful. And exactly what makes the governance plane non-optional at scale.

Why Autonomous Tool Access Creates a Different Class of Risk

There is a meaningful difference between an employee using ChatGPT to draft an email and a ChatGPT Work agent running for three hours with OAuth access to your email, CRM, calendar, and file systems.

In the first case, a human sees every output before it leaves the building. In the second, the agent is a privileged identity inside your enterprise — reading data, calling tools, taking actions — and most of that activity is invisible to your identity governance system, your DLP tooling, and your audit trail.

The architecture that makes ChatGPT Work fast is the same architecture that creates uncontrolled blast radius. Agents connect to tools via MCP. Those connections are configured per user, which means IT security has no visibility into them until something goes wrong. When four parallel agents are coordinating across workstreams — as in Ultra mode — one unnoticed error doesn't stay contained. It propagates downstream into every subsequent step.

OpenAI is transparent about this: "Can agents stay reliable across hours of work? One unnoticed error can spread through every later step."

That is not a speculative risk. It is the documented failure mode of autonomous multi-step execution. The controlled MCP interfaces that prevent error propagation don't exist inside ChatGPT Work by default. They have to be added by the teams deploying it.

What Enterprise Teams Should Do Before Enabling ChatGPT Work

This is not a reason to block ChatGPT Work. It's a reason to deploy it correctly before you deploy it broadly.

Scope OAuth access before enabling. ChatGPT Work's default prompts encourage connecting all available apps. Resist that. Define which tools each use case actually needs, grant the minimum access scope, and document the reasoning. "Connect everything" is a test posture, not a production posture.

Assign a named human owner to every agent instance. Every ChatGPT Work workflow that touches production data — email, CRM, shared drives — should have a named human who is accountable for what it does. If you can't name the owner, the workflow isn't production-ready.

Gate destructive actions before the workflow runs. External sends, record deletions, CRM writes, account changes, and file overwrites should require human approval before they execute — not human review after the fact. The approval should be a hard stop, not a notification.

Log every tool call. You need the audit trail. Not for compliance theater, but because when something goes wrong in a multi-step autonomous workflow, you need to know exactly what the agent did, in what order, and against which systems. Waiting until incident response to discover you have no logs is not a recoverable position.

These controls are implementable today without any additional tooling. But they require discipline that most teams won't sustain manually as ChatGPT Work usage scales across the organization.

How Waxell MCP Gateway Governs ChatGPT Work

Waxell MCP Gateway sits between ChatGPT Work and every tool it connects to. One URL per tenant replaces all upstream MCP configs — ChatGPT Work, Claude Desktop, Cursor, and any other MCP-compatible client points at the gateway, and the gateway governs what happens next.

Every tool call that ChatGPT Work makes passes through the gateway before it reaches Salesforce, Gmail, GitHub, Slack, or any of the 160+ upstream connectors Waxell supports. PII is redacted in flight. Secrets — API keys, tokens, credentials — never leave the gateway. A tool description that drifts from its trusted fingerprint triggers a drift alert; Waxell's prompt injection scanner runs at fingerprint time, before any agent calls the tool.

For destructive actions — external sends, deletions, permission changes — the gateway holds the MCP connection open while an approval request routes to the designated human. The agent pauses. Nothing executes until a human approves or denies. Policy changes propagate across all connected agents in 30 seconds.

This is what the steps above look like when they're enforced rather than hoped for. The policies fire before the action, not after. When ChatGPT Work's Ultra mode spins up four parallel agents, all four operate inside the same policy perimeter.

Waxell ships 50+ policy categories out of the box — Cost, Identity, Privacy, Safety, Delegation, Control, and more — mapped to the governance frameworks that enterprise security teams are accountable for: OWASP LLM Top 10, NIST AI RMF, ISO 42001, EU AI Act, GDPR, HIPAA.

ChatGPT Work is a compelling product. Governing it doesn't require slowing it down. It requires making sure the tool calls it makes are the tool calls your policies permit.

FAQ

Is ChatGPT Work safe for enterprise use?

ChatGPT Work can be used safely in enterprise environments, but it requires deliberate governance that doesn't ship by default. Specifically: scoped OAuth access, named human owners per workflow, approval gates on destructive actions, and full tool-call logging. Without those controls, an autonomous agent with standing access to email, CRM, and file systems represents an uncontrolled blast radius.

What apps and tools does ChatGPT Work connect to?

ChatGPT Work connects to local files, browsers, and desktop apps, as well as any tools configured as MCP servers. In practice this includes email clients, calendar systems, CRM platforms like Salesforce, project management tools like Jira, code repositories, shared drives, and Slack. The exact scope depends on which OAuth connections an employee or admin enables — which is why scoping those connections before deployment matters.

How do you audit what ChatGPT Work did?

ChatGPT Work does not provide a native enterprise-grade audit trail for tool calls. To get durable, queryable logs of what the agent accessed, what tools it called, and what data it read or wrote, you need an external governance layer. Waxell MCP Gateway logs every tool call passing through the gateway — durable, CSV-exportable, no payloads stored.

Can you block specific tool actions in ChatGPT Work?

Not natively. ChatGPT Work's access controls are per-user OAuth grants. To enforce tool-level policies — blocking specific tool calls, requiring approval before destructive actions execute, or applying PII redaction in flight — you need a governed MCP endpoint. Waxell MCP Gateway applies policies at the tool level, with five fingerprint states and 30-second policy propagation.

What's the difference between ChatGPT Work and ChatGPT Enterprise?

ChatGPT Enterprise is OpenAI's organizational subscription tier — it controls data retention, SSO, admin access, and usage policies. ChatGPT Work is the autonomous agent mode within ChatGPT, available on Pro, Enterprise, and Edu plans. Enterprise governs the access layer. ChatGPT Work is the execution layer. Neither provides granular governance of what the agent does with the tools it has access to once connected — that requires an external layer like Waxell MCP Gateway.

Sources: