OpenAI DevDay 2026: the security questions behind agents, plugins and sign-in

Simon Willison live-blogged the OpenAI DevDay 2026 keynote. Most of it was product news: new models, pricing tiers and a collaborative workspace. A subset matters to security teams because it changes what an AI agent can reach and who can extend it. This post covers only that subset, and only what the live blog records.

What was announced that touches the attack surface

• Agents API with Computer Use. The Agents API was updated to include computer-use capabilities, so agents can operate software the way a user would.
• Plugin Extensions. These are described as full applications that appear native inside ChatGPT and Codex.
• OpenAI Marketplace. It launched with listed partners including Adobe, Canva, Figma, Notion, Salesforce, Vercel and Zendesk.
• Sign in with ChatGPT. This lets apps use a user's existing ChatGPT tokens for authentication.
• Codex Security Cloud. This adds scheduled scans and automatic deduplication, plus an open-source CLI and a verify-fix adversarial validation step.

Why computer use raises the stakes

An agent that can click, type and read screens acts with whatever authority its session holds. Anything it reads is input to the model: web pages, documents, tickets, email. That is the standard setting for indirect prompt injection. Text an attacker controls can be interpreted as an instruction, and the agent's own permissions then carry it out.

The defensive baseline does not depend on any vendor. Give agents least-privilege, task-scoped credentials. Require human confirmation for irreversible or high-value actions. Log every tool call and action in a form your incident responders can replay. Assume that content the agent ingests is hostile.

Plugins, marketplaces and delegated tokens

A marketplace of extensions that run natively inside an assistant resembles a package ecosystem. The lessons from npm and PyPI apply: provenance, review depth, update controls and revocation all matter. The keynote coverage does not say how extensions are vetted or permissioned. Enterprises should ask before enabling them.

Sign in with ChatGPT is a delegated-identity feature. The questions are the usual OAuth ones. Which scopes does an app receive? How long do tokens live? Can an administrator see and revoke grants? The live blog does not cover these details, so confirm them in OpenAI's documentation rather than assuming.

Security tooling: useful, but measure it

Codex Security Cloud is pitched with scheduled scans, deduplication and a verify-fix step that adversarially checks whether a fix works. Automated validation of fixes is a sensible direction. Findings still need human triage, and you should benchmark the tool against known-vulnerable code from your own estate. Its false-negative rate matters more than its deduplication.

A practical checklist

1. 1Inventory where agents, plugins or ChatGPT-based sign-in would touch production data.
2. 2Threat-model each agent for indirect prompt injection and tool abuse before launch.
3. 3Restrict marketplace and plugin enablement to an approved list.
4. 4Scope and monitor delegated tokens, and rehearse revoking them.
5. 5Red-team the full workflow, not just the model in isolation.

The live blog is a first-hand account of a keynote, not a technical specification. Confirm each capability, permission model and pricing detail against OpenAI's own documentation before making architectural decisions.