“Meanwhile, ChatGPT plugins (produced by OpenAI, which they have a close tie with) open a wide range of security problems: those plugins can access the internet, read and write files, and impersonate people (e.g., to phish for credentials), all alarms to any security professional.”
Our reading, the sentence that was checked:
ChatGPT plugins open a wide range of security problems, since they can access the internet, read and write files, and impersonate people (e.g., to phish for credentials), all of which would alarm any security professional.
Assessment: Supported Evidence as of
Where and when Gary Marcus wrote it
Marcus on AI, Two models of AI oversight - and how things could go deeply wrong, paragraph 19.
- Said
- Source observed
- live page, full text, public
- Evidence as of
- the cutoff for this assessment
- Assessment recorded
- assessment marcus-two-models-of-ai-oversight-and-how-c80a72-a1
We recorded 20 claims from this post. See every claim from this post.
The wording above is the version this site observed on 2026-10-29. The source may have been edited after 2023-06-08. This page does not claim the wording was captured then.
What the claim commits to
- Kind
- Observation
- Deadline, as the speaker wrote it
- None stated. This site does not add one.
- Deadline state when assessed
- No horizon
- Deadline state on 2026-10-29
- No horizon (the release’s reference date)
From the speaker
- ChatGPT plugins
- open a wide range of security problems
- access the internet
- read and write files
- impersonate people (e.g., to phish for credentials)
- all alarms to any security professional
Our interpretation
- The claim concerns capabilities and security risks across the plugin ecosystem, not a requirement that every plugin possess every capability.
- File access includes files in the code interpreter's workspace and connected services; it does not imply unrestricted access to a user's computer.
- Impersonation includes malicious use of a person's delegated authority or deceptive communications. Phishing is an example of the risk, not an assertion of a named successful credential theft.
- The reference to any security professional is rhetorical emphasis rather than a literal survey claim.
- For this ongoing observation, use the current plugin release period, March 23 through June 8, 2023.
Counts as supported if: Contemporaneous documentation establishes internet and file capabilities, and documentation or demonstrations establish concrete risks of deceptive communications, unauthorized use of delegated authority, or sensitive-data exposure.
Counts as contradicted if: The named capabilities were unavailable in the relevant period, or the purported attacks concerned unrelated products and the claimed mechanisms were technically excluded by the released architecture.
Retrospective: these criteria were written after the outcome was public.
Current assessment
Was it true for the period described?
Outcome: Supported
The dated evidence matches what the claim committed to, under the criteria frozen before grading.
Scored on a plain reading. The speaker named no measure for this claim, so it was judged on the reading an informed reader would take, stated below under our interpretation. Both reviews had to find that reading fair.
- Evidence as of
- Deadline state when assessed
- No horizon
- Assessment recorded
- Policy version
- 2026-10-28.7
Rationale
The ordinary capability-and-risk reading is supported. OpenAI documented browsing, workspace file operations, and security concerns. A May demonstration showed malicious webpage instructions abusing delegated access to extract private email. Safeguards and a reported fix matter: this does not establish unrestricted access, universal vulnerability, or a completed credential-phishing attack.
Limitations
- Support concerns the ecosystem's capabilities and attack mechanisms, not every individual plugin.
- OpenAI's fraudulent-email finding explicitly concerned configurations without safeguards.
- The file capability was sandboxed, and the demonstrated email attack was reported mitigated.
- The phishing example is supported as a risk mechanism, not as a verified historical victimization.
Evidence (3 items)
Supports the claim: OpenAI,
We support uploading files to the current conversation workspace and downloading the results of your work.
Why it matters here: The launch documentation establishes browsing and file-processing capabilities and reports fraudulent-email and prompt-injection findings without safeguards. It also describes sandboxing, network controls, and a GET-only browser, which limit the claim's scope.
- Publisher
- OpenAI
- Kind of source
- Company disclosure: the company describing itself, not an independent finding
- Describes events of
- Public from
Supports the claim: Johann Rehberger, Embrace The Red,
ChatGPT follows instructions and retrieves the user’s email, summarizes and URL encodes it.
Why it matters here: The demonstration used webpage instructions to misuse a connected user's authority and extract private email; the page links its May 19 public demonstration. It also reports that Zapier added authenticated confirmation, so the exploit is not evidence that this exact path remained open on June 8.
- Publisher
- Johann Rehberger, Embrace The Red
- Kind of source
- Demonstration
- Describes events of
- Public from
Context only: Umar Iqbal, Tadayoshi Kohno, and Franziska Roesner; arXiv,
Hijacking an account can result in multiple harms to the user, including stealing of private data and impersonation of the user.
Why it matters here: The researchers explain phishing and misuse of delegated authorization as plugin attack mechanisms. Their analysis spans June 6 through July 31, so this general discussion is context rather than proof of a specific pre-June 8 phishing incident.
- Publisher
- Umar Iqbal, Tadayoshi Kohno, and Franziska Roesner; arXiv
- Kind of source
- Preprint, not peer reviewed
- Describes events of
- Public from
Where it was said (1)
Said once in the sources this register covers.
: Marcus on AI, Two models of AI oversight - and how things could go deeply wrong
Meanwhile, ChatGPT plugins (produced by OpenAI, which they have a close tie with) open a wide range of security problems: those plugins can access the internet, read and write files, and impersonate people (e.g., to phish for credentials), all alarms to any security professional.
- Where
- paragraph 19
- Published
- 2023-06-08
- Source observed
- , live page
- Access
- full text, public
History
Assessment versions
- Assessment marcus-two-models-of-ai-oversight-and-how-c80a72-a1: Current. Outcome: Supported. Evidence as of 2026-10-28. Public date not recorded.
Recorded events
Assessment publishedBy this site
First assessment published after both reviews and the final-text check passed.
About assessment marcus-two-models-of-ai-oversight-and-how-c80a72-a1.