What changed
OpenAI enabled ChatGPT Work and Codex to discover and call WebMCP tools supplied by supported websites in the desktop app's built-in browser. Users can inspect whether a tool reads or changes data and review recently used tools after a call.
Why it matters
Website-declared tools can replace brittle click automation with explicit read and write operations, but they also move trust into a site's tool definitions, the user's live signed-in session, and a new prompt-injection and data-exfiltration boundary.
What to do
Use a non-production account on one trusted WebMCP-enabled page. Inspect every advertised tool and whether it reads or changes data, run a read-only task, review the recorded tool activity, then test denial and confirmation for sharing, messages, purchases, deletion and permission changes. Disable site tools in Browser settings if the workflow does not need them.
Caveat
Site tools require a supported account, model and webpage and currently work only in the desktop app's built-in browser, not the Chrome extension. Websites decide which tools to expose; tools can reveal functions not visible in the page UI, and OpenAI explicitly warns about prompt injection and data exfiltration.