“I don’t see any reason to think these plugins are in fact safe. (They are far less sandboxed and less rigorously controlled than Apple app store apps.)”
Our reading, the sentence that was checked:
Marcus says he does not see any reason to think ChatGPT plugins are in fact safe, noting that they are far less sandboxed and less rigorously controlled than Apple App Store apps.
Assessment: Unresolved Evidence as of
Where and when Gary Marcus wrote it
Marcus on AI, Two models of AI oversight - and how things could go deeply wrong, paragraph 19.
- Said
- Source observed
- live page, full text, public
- Evidence as of
- the cutoff for this assessment
- Assessment recorded
- assessment marcus-two-models-of-ai-oversight-and-how-8123c6-a2
We recorded 20 claims from this post. See every claim from this post.
The wording above is the version this site observed on 2026-10-29. The source may have been edited after 2023-06-08. This page does not claim the wording was captured then.
What the claim commits to
- Kind
- Observation
- Deadline, as the speaker wrote it
- None stated. This site does not add one.
- Deadline state when assessed
- No horizon
- Deadline state on 2026-10-29
- No horizon (the release’s reference date)
Conditions
- I don't see any reason (qualifier, stated by the speaker)
From the speaker
- I don’t see any reason to think these plugins are in fact safe
- far less sandboxed
- less rigorously controlled than Apple app store apps
Our interpretation
- The checkable commitment is the comparison of safeguards. Marcus’s statement about his own confidence is not independently measurable.
- The plain reading is that the contemporary ChatGPT plugin system imposed substantially weaker isolation and review controls than Apple’s App Store system.
- Assess the initial plugin deployment through the post date. The start is the public plugin launch, because the context concerns the current product rather than a financial reporting period.
- Compare enforced isolation, permissions, review and continuing oversight. Neither platform must be entirely free of vulnerabilities.
- Distinguish OpenAI-hosted tools from third-party plugins. Their safeguards need not be identical.
Counts as supported if: Documentation or reproducible analysis of the contemporary systems establishes substantially weaker isolation and less rigorous review or enforcement across the relevant ChatGPT plugin system.
Counts as contradicted if: Comparable documentation or testing establishes that the relevant plugin system had equivalent or stronger isolation or review controls, materially defeating the claimed comparison.
Retrospective: these criteria were written after the outcome was public.
Current assessment
Was it true for the period described?
Outcome: Unresolved
The record was checked, and the evidence available by the cutoff does not settle it.
Scored on a plain reading. The speaker named no measure for this claim, so it was judged on the reading an informed reader would take, stated below under our interpretation. Both reviews had to find that reading fair.
- Evidence as of
- Deadline state when assessed
- No horizon
- Assessment recorded
- Policy version
- 2026-10-28.7
Rationale
Apple's May 2022 guide describes iOS and iPadOS app sandboxing, and its May 16, 2023 disclosure describes automated checks and human app review [e2, e3]. OpenAI's March 23, 2023 announcement describes a sandboxed, firewalled code interpreter [e1]. Researchers reported no observed anonymization of user input in a June 7, 2023 Clinical Trial Radar interaction; the cited research version became available July 26, 2024 [e4]. These sources document safeguards and a privacy concern, but do not establish equivalent security boundaries or a complete comparison of contemporary review and enforcement [e1–e4]. They therefore neither establish nor refute the claimed system-wide difference during March 23–June 8, 2023 [e1–e4].
Limitations
- The packet lacks a sufficiently complete account of OpenAI's review and enforcement during the target period.
- Device-app sandboxing and hosted-tool isolation are not compared using a common security boundary or measure.
- One plugin interaction does not establish system-wide behavior; code-interpreter safeguards do not establish protections for all third-party plugins.
- Company descriptions do not independently establish safeguard effectiveness.
Evidence (4 items)
Context only: OpenAI,
sandboxed, firewalled execution environment
Why it matters here: OpenAI described concrete isolation for its code interpreter. This is material against treating all plugins as lacking safeguards, but it does not establish equivalent protection across third-party plugins or against Apple's controls.
- Publisher
- OpenAI
- Kind of source
- Company disclosure: the company describing itself, not an independent finding
- Describes events of
- Public from
Context only: Apple,
safety checks
Why it matters here: Apple described checks on every submission, including automated checks and human review. This establishes the Apple side of the comparison, but does not measure OpenAI's review rigor.
- Publisher
- Apple
- Kind of source
- Company disclosure: the company describing itself, not an independent finding
- Describes events of
- Public from
Context only: Apple; copy hosted by MIT,
Sandboxing
Why it matters here: The guide explains Apple's device-level isolation boundary. It predates the target period and does not compare that boundary with remote plugin services; the availability date is a conservative month-end bound for the May 2022 edition.
- Publisher
- Apple; copy hosted by MIT
- Kind of source
- Company disclosure: the company describing itself, not an independent finding
- Describes events of
- Public from
Context only: Umar Iqbal, Tadayoshi Kohno and Franziska Roesner via arXiv,
anonymize user input.
Why it matters here: The researchers dated this interaction to June 7 and reported failure to follow the plugin's anonymization instructions. It substantiates a contemporary privacy concern, but supplies no matched Apple comparison.
- Publisher
- Umar Iqbal, Tadayoshi Kohno and Franziska Roesner via arXiv
- Kind of source
- Preprint, not peer reviewed
- Describes events of
- Public from
What would settle it
Archived requirements and enforcement records for the March 23–June 8, 2023 plugin system, together with matched analysis of isolation, permissions, review and continuing oversight against the relevant Apple platforms.
Where it was said (1)
Said once in the sources this register covers.
: Marcus on AI, Two models of AI oversight - and how things could go deeply wrong
I don’t see any reason to think these plugins are in fact safe. (They are far less sandboxed and less rigorously controlled than Apple app store apps.)
- Where
- paragraph 19
- Published
- 2023-06-08
- Source observed
- , live page
- Access
- full text, public
History
Assessment versions
- Assessment marcus-two-models-of-ai-oversight-and-how-8123c6-a2: Current. Outcome: Unresolved. Evidence as of 2026-10-28. Public date not recorded.
Recorded events
Assessment publishedBy this site
First assessment published after both reviews and the final-text check passed.
About assessment marcus-two-models-of-ai-oversight-and-how-8123c6-a2.