OpenAI Firewall

The surface

OpenAI on the endpoint

From a desktop app with accessibility-level reach to a coding agent with a shell, OpenAI's stack acts on the device — not just in the chat window.

Desktop app

ChatGPT — Work with Apps

Uses the macOS Accessibility API to read content from IDEs, editors, and note apps — silently sending on-screen code and text as context.

Coding agent

Codex CLI & cloud

Executes model-generated shell commands locally. Sandbox and approval levels (read-only → danger-full-access) set in config.toml; project instructions read from AGENTS.md.

Browser agent

ChatGPT Agent & Atlas

Agent mode signs into sites, reads mail and files, and acts across the web; the Atlas browser adds persistent Browser Memories to the mix.

Custom agents

GPTs & connectors

Custom GPTs with Actions hold OAuth credentials to external systems; developer mode wires any custom MCP connector, including write actions, into ChatGPT.

Where the risk lives

Memory, connectors, and a shell

Attack surface

Accessibility reach — the desktop app reads other applications' windows; whatever is on screen can leave the device as context.
Persistent memory — poisoned instructions written to ChatGPT Memory re-execute in every future session.
Connectors & MCP — native controls are coarse (all / read-only / custom); no payload inspection on what flows through.
Instruction files — AGENTS.md is trusted project context for Codex and other tools; a cloned repo can carry injected instructions.
Personal accounts — consumer ChatGPT with memory, connectors, and agent mode is invisible to the Enterprise Compliance API.

Documented in the wild

Memory poisoning — "ZombieAgent"-class attacks persisted malicious prompts into Memory via email, exfiltrating data session after session.
Calendar-invite exfil — a crafted invite (victim's address alone sufficed) swept private email through a connector to the attacker.
Codex token theft — command injection in the cloud agent exposed GitHub access tokens (patched).
GPT Store exposure — an academic sweep of ~15,000 GPTs found the vast majority inadequately defended, with over-privileged Action credentials.

Native controls see the conversation, not the device. The Enterprise admin console and Compliance API capture chats, files, and memories — for enterprise accounts. They don't see what the Accessibility API read, what a Codex shell command did to the filesystem, or anything a personal login does on a corp laptop. OpenAI concedes injection defenses won't stop everything; containment has to live on the endpoint.

Admin plane integration

We plug into your OpenAI admin plane

Ospiri connects to the ChatGPT Enterprise console and OpenAI's compliance and audit APIs — and reconciles them with what happened on the device.

What OpenAI's admin plane exposes

Enterprise admin console — members, custom roles, SSO/SCIM, workspace analytics, GPT creation/sharing controls, and per-action connector ("apps") approvals.
Compliance API / Compliance Logs Platform — timestamped conversations, uploaded files, GPT configurations, memories, projects, and users, plus Admin Audit, User Authentication, and Codex Usage log categories as immutable JSONL exports.
API-platform Admin API — org users, projects, service accounts, an Audit Logs API, and Usage/Cost APIs.

What Ospiri does with it

Ingest & correlate — compliance logs and Codex usage records are joined with kernel telemetry: OpenAI logs the conversation; Ospiri shows the files, processes, and egress behind it.
Close the console's blind spots — personal accounts, Accessibility-API reads, and local Codex shell activity never reach the Compliance API; Ospiri covers all three and reconciles them against the workspace.
Push policy back — findings feed connector approvals and GPT controls, so response lands in both planes.

Endpoint or cloud — same firewall. Coverage applies whether the agent is ChatGPT on a laptop, Codex in a cloud container, or an Agents-SDK service deployed on AWS or Azure: admin-plane signals in, runtime control at the point of action.

The fix

How Ospiri governs OpenAI

Visibility

Inventory every OpenAI runtime on the fleet — desktop app, Codex, Atlas, agent sessions — and flag personal-account usage the Compliance API structurally can't see.

Sandboxing

Kernel-level fences independent of Codex's own sandbox levels: keep agents out of secrets and production paths, contain network egress, and divert risky writes to copy-on-write clones.

Anomalies

Per-agent baselines catch memory-poisoning behavior patterns — the session that suddenly emails an unknown address or reads paths it never touched — with timestamped, replayable evidence.

Skills

Scan AGENTS.md, GPT configurations, and instruction files for injected payloads and embedded credentials before execution; re-scan on every update.

MCP

Discover every connector and custom MCP server (including developer-mode write actions), inspect traffic in flight, and enforce per-agent allow-lists — every tool call logged.

The OpenAI Firewall