OpenAI brings ChatGPT to the web and services with plugins

On March 23, 2023, OpenAI introduced ChatGPT plugins; connecting a model to data and actions teaches a durable rule: every tool expands usefulness and attack surface at the same time.

OpenAI today unveiled ChatGPT plugins, giving the assistant a way to move beyond the data it was trained on and use external tools. The new feature allows it to search for up-to-date information on the web, run code and access third-party services from within a conversation.

Access will initially be limited to ChatGPT Plus users and developers who have joined a waitlist. It is not yet a broadly available feature, but it marks a significant shift: ChatGPT is moving from generating text to being able to retrieve data and take action through connected applications.

Three tools to expand ChatGPT

OpenAI is launching two in-house plugins. The first allows ChatGPT to browse the internet through Bing's search API. Until now, ChatGPT's knowledge had a cutoff date, and it could not verify what had happened recently. With this tool, it can run searches, open results and cite the pages used in its response.

The feature has deliberate limits. The browser makes read-only requests—it cannot fill out forms or take actions equivalent to making a purchase—and it respects the restrictions websites specify in their robots.txt files. Even so, access to the web introduces a familiar problem: a page may contain instructions designed to confuse the model or alter its behavior. This is known as prompt injection, a form of manipulation that uses text directed at the AI.

The second plugin is a code interpreter. It gives ChatGPT access to an isolated environment where it can write and run Python, a programming language widely used for data analysis. Users can upload files and ask the system, for example, to clean up a spreadsheet, generate a chart or convert file formats. For many office tasks, this capability is more valuable than a fluently written answer: it makes it possible to verify calculations and work with concrete data.

From answering questions to using services

The most ambitious part of the announcement is the set of plugins developed by outside companies. This initial test includes, among others, Expedia and KAYAK for travel; OpenTable for restaurants; Instacart for shopping; Klarna for products; FiscalNote for legal and political information; Speak for language learning; Wolfram for calculations and scientific knowledge; and Zapier for connecting thousands of business applications.

The idea is straightforward: instead of opening several websites, users could describe a need in everyday language and let ChatGPT access the appropriate service. Asking for flight options, finding an available table or analyzing a company's data are immediate examples. The outcome will nevertheless depend on each service providing reliable data, the model formulating its queries correctly and the user reviewing the response before making a decision.

OpenAI is also releasing an information-retrieval, or retrieval, plugin that allows developers to connect ChatGPT to their own documents and knowledge bases. It is a practical alternative for companies that want to query the AI about internal manuals, contracts or technical documentation without having to retrain a model from scratch.

The beginning of connected assistants

Language models have excelled at drafting, summarizing and conversing, but their usefulness declines when they need up-to-date information or access to real-world systems. Plugins target precisely that limitation. They also change the nature of the risk: an error in a piece of text can be annoying; an error when recommending a product, interpreting a regulation or sending data to an external service can have more concrete consequences.

That is why OpenAI has opted for a small, gradual rollout. The company says it has conducted safety testing and acknowledges that these tools may introduce new forms of misuse. The caution is justified: connecting a model that can make mistakes to the web and commercial platforms requires technical safeguards, clear permissions and human oversight.

The trial will show whether ChatGPT can become a useful interface for digital services or whether the complexity of integrating data, instructions and actions means these features must remain limited to tightly defined use cases. For now, OpenAI has opened a race to ensure conversational assistants do more than talk about the world—they may also be able to access the tools that operate in it.

Reading, computing and acting carry different levels of risk

A browser can retrieve untrusted text; an interpreter runs code in an environment; a commercial plugin consults or changes a service. The shared label “tool” is insufficient. Document inputs, outputs, permissions and effects for each integration. Reading a page can leak context through a malicious instruction; purchasing or booking adds economic consequences.

OpenAI’s introduction described a gradual rollout and acknowledged new risks. The model receives a plugin description and decides when to call it, but that probabilistic choice does not replace policy. Sensitive actions need confirmation with visible parameters: item, quantity, price, recipient and account.

Prompt injection occurs when external content tries to behave as an instruction. Defence is not merely telling the model to ignore attacks. Separate data from instructions, restrict callable tools, validate arguments and block secret exfiltration. The rule is familiar from classical security: untrusted input does not gain authority by being fluently written.

A simple approval matrix for integrations

Test four cases: normal answer, missing data, malicious content and external-service outage. The assistant should cite retrieved information, abstain when it is missing, reject embedded instructions and fail without leaving a partial action. Then inspect logs to reconstruct what the user requested and what the tool received.

Permissions should be minimal and revocable. A calendar plugin that reads availability does not need to delete events; a shopping plugin does not need a user's entire history. Use a test account, grant the narrowest scope and revoke it afterwards. Useful integration does not justify a permanent, opaque credential.

Reliability also needs a denominator. Successful demos do not reveal how many calls failed. Record total attempts, correct actions, blocked errors, missed errors and cancelled confirmations. That distribution supports a decision between automation and keeping the assistant in a proposal-only role.

The transferable skill is to classify every connection as reading, computing or acting and raise controls with possible harm. Before enabling a plugin, ask what it can see, what it can change, who confirms and where the trace remains. Utility grows with tools; responsibility grows too.

Assign an owner to every plugin before deployment. That person reviews permission changes, incidents and versions and can disable it without waiting for the provider. A catalogue without owners accumulates forgotten integrations that retain access.

Users should also know when a tool was involved. The answer should show which service was consulted, which data it returned and whether an action ran. That visibility directs remediation to the right component: model, plugin or source. Without it, an error appears as a spontaneous chatbot claim and becomes difficult to investigate.

A periodic review asks whether the plugin is still necessary. If the function now exists elsewhere, the provider stopped maintaining it or nobody uses it, revoke and remove it. Reducing inactive integrations improves security without requiring a smarter model.

Removal should verify that credentials were revoked and no events or data still arrive. Uninstalling an interface without closing background access leaves an invisible integration.