Topic starter
24/07/2026 4:10 pm
TL;DR: ChatGPT’s ability to connect to remote Model Context Protocol servers lowers the barrier to tool-triggering while expanding data exposure, approval, and supply-chain risk, according to Noma Security. The governance gap is not the protocol itself but the assumption that human-paced controls can safely supervise machine-triggered actions at scale.
Editorial analysis by NHI Mgmt Group, based on content published by Noma Security: “Critical recommendations for the secure use of MCP servers via ChatGPT”.
Key questions
Q: What breaks when ChatGPT sessions can connect to remote MCP servers?
A: The main failure is that conversational access becomes an execution path.
Q: Why do remote MCP connections increase data exposure risk?
A: Because the model may send more context than the user intended in order to complete the task.
Q: What do security teams get wrong about approving MCP write actions?
A: They often assume the approval prompt is the control, when the real control is whether the model correctly recognised the action as harmful.
Practitioner guidance
- Approve only a fixed MCP server inventory Maintain an organisational allowlist of verified MCP servers and block ad hoc connections until each server has an owner, review status, and documented purpose.
- Separate read and write MCP permissions Treat read-only discovery, context retrieval, and write-capable actions as different trust levels, with explicit approval for anything that changes state or sends communications.
- Inspect model-to-server data flows Log what context the model sends to each MCP server, then review those traces for oversharing, unintended prompt injection effects, and sensitive data movement.
Bottom line: ChatGPT MCP connectivity turns a chat session into a governed execution path, which changes the identity and access problem for AI programmes.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
24/07/2026 4:15 pm
ChatGPT-to-MCP connectivity is a governance boundary, not a convenience feature: once a conversational interface can invoke external tools, the organisation is governing execution paths and data movement, not just prompts. That changes the control surface for IAM, NHI, and AI governance at the same time. The practitioner implication is that every allowed MCP server becomes part of the identity perimeter.
A few things that frame the scale:
- 24,008 unique secrets were exposed in MCP configuration files in 2025 alone, the protocol's first year of widespread adoption, according to the State of Secrets Sprawl 2026.
- AI-related credential leaks surged 81.5% year-over-year in 2025, with the surrounding AI infrastructure leaking 5x faster than core LLM providers, according to the State of Secrets Sprawl 2026.
A question worth separating out:
Q: What is the difference between trusted MCP server lists and runtime monitoring?
A: Trusted server lists decide what may connect, but runtime monitoring shows what the session actually sends and receives. Both are needed. Allowlists reduce exposure at onboarding, while monitoring catches prompt injection, oversharing, and unexpected write attempts after the connection is active.
👉 Read our full editorial: ChatGPT MCP access expands the attack surface for AI governance