What This Comes Down To
ChatGPT agent mode reaches company data two ways: through connectors to apps like mail, drives and CRMs, and through a browser that acts for the user. OpenAI says connectors respect existing permissions, so the agent sees what that person can see. Your job is to shrink that reach, log it, and point the agent at curated lakehouse data instead of raw systems.
- What it can touch: connected apps and web pages the user can already open.
- Main risk: broad existing permissions and untrusted web content steering the agent.
- Controls: workspace app permissions, write-action approvals, least privilege at the source.
- Best pattern: give it narrow, governed datasets with audit logs, not production systems.
Treat ChatGPT agent mode as a new user on your network that borrows an existing user’s badge. According to OpenAI‘s help center, connectors respect existing content permissions, so ChatGPT only sees what each person is allowed to access. That is the right design, and it moves the question from “is the agent safe?” to “is our permission model clean?”
The security community has already catalogued how agents go wrong. On 9 December 2025 the OWASP GenAI Security Project released its first Top 10 for Agentic Applications, and its first entry, ASI01 Agent Goal Hijack, describes exactly what a browsing agent faces when a web page carries instructions meant for it.
In practice the problems are ordinary. A connector granted to a whole team reaches a folder with HR files in it. An agent task that reads a vendor portal also reads a hidden instruction on that page. Nobody can say afterward which records the agent opened, because the only log is the chat history. These are access control and logging gaps, and they are fixable.
Two Paths Into Company Data: Connectors and the Browser
Agent mode is ChatGPT working through a multi-step task on its own, rather than answering one prompt. At work, it reaches company information through two different doors, and each needs its own control.
Connectors link ChatGPT to apps your company already runs: file storage, mail, calendars, CRMs and similar. Each connector is authorized by a user or configured by an admin, and it reads within that account’s permissions. A connector is effectively a standing pipeline from a source system into an AI session, and it deserves the same inventory and review you give any other integration.
The browser lets the agent open pages, click and fill in forms. OpenAI retired its separate Atlas browser on 9 August 2026 and moved browser-based agent work into ChatGPT and the ChatGPT desktop app, adding multiple tabs, downloads and account logins where available. Wherever it runs, the agent acts on whatever its browser session can reach, which includes internal web apps the user is signed into.
That second door is the one most teams forget. An internal dashboard with no API still shows data to a browser, so a browsing agent can read it. If you would not let a contractor click through that dashboard unsupervised, decide deliberately whether an agent should.
Admin Controls Worth Setting Before Rollout
On business plans, OpenAI’s help center describes workspace controls for when ChatGPT asks members for confirmation before using connected apps, and approval settings for write actions during an agent run, which it says default to asking. It also describes action constraints that agent builders can use to limit what a connector is allowed to do. Check the exact options in your own admin console, because they differ by plan and change often.
My recommended settings are conservative on writes and selective on reads:
| Surface | What agent mode can reach | Control to set | What to log |
|---|---|---|---|
| File and document connectors | Files the user can open, including anything shared broadly | Remove company-wide sharing on sensitive folders before enabling | Connector grants per user, and file reads where the source logs them |
| Mail and calendar connectors | The user’s mailbox and calendar contents | Allow only for roles that need it; keep writes on approval | Which accounts hold the connector, reviewed monthly |
| CRM and ticketing connectors | Records visible to that user’s role | Tighten role scopes; prefer a curated export over live access | Source-side API audit logs tied to the user identity |
| Browser agent | Any site the user’s browser can open, including internal apps | Keep humans on approval for submissions; restrict sensitive internal apps | Proxy or identity-provider logs of agent sessions |
| Governed lakehouse data | Only the gold tables and views you publish | Attribute-based masking and row policies on tagged data | Platform audit table plus column-level lineage |
What Goes Wrong When Agents Meet Raw Systems
The failures follow one pattern. Teams connect the agent straight to the systems of record because that is fastest, and the agent inherits every permission mistake those systems carry. A shared drive with a decade of “anyone in the company” links becomes an agent-readable archive overnight. Each source keeps its own logs in its own format, so reconstructing what the agent read means pulling exports from four vendors and matching timestamps by hand. The browser path adds untrusted input: a page the agent reads can carry instructions, which is why OWASP treats goal hijacking as its first agentic risk. Meanwhile the data the agent quotes has no lineage, so when it reports a revenue figure nobody can tell which table, which filter or which refresh produced it. None of that is a flaw in ChatGPT. It is what happens when data sits in silos with separate permission models and no common audit trail, and an agent arrives that can read all of them at once.
Give the Agent Governed Data Instead of Raw Access
The durable fix is architectural. Instead of connecting an agent to five systems of record, publish the data it needs as curated gold tables in one governed lakehouse and let the agent read only those. You trade breadth for control, and in my experience the answers improve too, because curated data carries consistent definitions.
On Databricks, that pattern rests on a few verified pieces. Unity Catalog captures lineage automatically, down to the column level, so any figure an agent cites traces back to its bronze source. Attribute-based access control for row filtering and column masking, with governed tags and automated data classification, reached General Availability on 13 May 2026. The system.access.audit table, currently labelled Public Preview, records access with 365 days of default retention.
For the agent connection itself, Databricks positions Unity AI Gateway, generally available since 4 August 2026, as the control layer for models, agents, MCP servers, skills and tools, including external agents. Its MCP-specific governance was reported in Beta earlier in the year, so confirm current status before you design around it.
Two more pieces matter as much as the platform. First, context: an agent reading a well-described table with clear column comments makes fewer mistakes, which is the core of context engineering for AI agents. Second, guardrails on what comes back, covered in our note on RAG guardrails. If your team is building its own agents on OpenAI tooling rather than using agent mode, our walkthrough of building data science agents with OpenAI Agent Builder applies the same data discipline.
Process comes before plumbing here too. In the AIM-IT Assess step we map which questions people actually send to the agent, then publish only the datasets those questions need. A narrow, well-named gold layer beats a connector to everything.
The Order I Would Work In This Quarter
If agent mode is already switched on, or about to be, this is the sequence that produces the most risk reduction per week of effort.
- List every connector in use. Who authorized it, which system it reaches, and which roles hold it. This is a one-week job and it answers the first question any auditor asks.
- Fix oversharing at the source. Remove company-wide links and stale group grants on sensitive stores before widening agent access.
- Set write actions to approval. Reads carry exposure risk; writes carry business risk. Keep a human on every write until you have evidence you do not need to.
- Consolidate the logs. Land connector grants, identity sessions and data platform audit records in one queryable store.
- Publish governed datasets for the top questions. Move the agent’s most common work onto curated, classified lakehouse tables with lineage.
This is general information, not legal advice, and your counsel or a qualified assessor makes any compliance call for your organization.
If you want those governed datasets designed and built for agent use, that is the work our AI on the lakehouse practice does.
Frequently Asked Questions (FAQs)
Can ChatGPT agent mode see files I cannot open?
No. OpenAI’s help center states that connectors respect existing content permissions, so the agent sees only what the connected account can access. The exposure comes from accounts that already have broader access than they should.
Is ChatGPT agent mode safe for company data?
It is as safe as the permissions, approvals and logs around it. With clean source permissions, write actions on approval and agent access limited to curated datasets, the risk is manageable; with raw connectors to overshared systems, it is not.
What happened to ChatGPT Atlas?
OpenAI retired the Atlas browser on 9 August 2026 and moved its agent browsing into ChatGPT and the ChatGPT desktop app. For data governance nothing changes: the agent still works with the access of the signed-in user and the connectors they authorized, so the controls above apply wherever it runs.
What should we log when employees use agent mode?
Log which connectors each user has authorized, which identity the agent acted as, which data sources it read and what it changed. Keep those records in one store alongside your data platform’s audit logs so an investigation takes minutes, not weeks.