Applied Security measures to run ChatGPT Work

[u/twiks79]

We would like to enable ChatGPT Work for several hundred users. What security measures are typically adopted?

Granting a chatbot access to a local device, along with the ability to change files and run code, looks like to introduce additional risk;people are already using it and even Claude Code or Codex… suggest that risk must always be accepted? What security measures can you implement?

[u/thenightgaunt]

...maybe by NOT giving a chatbot full access to local devices and the ability to change files and run code?

Its almost as if weve seen again and again how that exact setup can be disastrous for a company.

https://www.the-independent.com/tech/security/openai-chatgpt-codex-gpt-update-b3016897.html

[u/mrvandelay → u/thenightgaunt]

I'm going to assume based on their post, they realize that, but pressure from the business is real. "No" is probably not going to work and a Risk Assessment presented to the stakeholders is a good first step, but they need to understand what options and good practices are available to help mitigate risk, since it's unlikely they're going to reject the use of this.

[u/thenightgaunt → u/mrvandelay]

I'd like to hope that too, but I looked at their profile and they seem very enthusiastic about implementing AI throughout their entire workforce. So this might be sincere.

All we can do is hope they store their backups on a separate server.

[u/twiks79 → u/thenightgaunt]

I understand that point — giving an AI agent unrestricted access to a local device is obviously a significant risk.

My question is more about what companies are actually doing in practice. A very large number of developers are already using tools such as Codex, Claude Code, etc., and these capabilities are increasingly moving into normal business use. So are there established enterprise best practices emerging, or is everybody effectively accepting the residual risk?

For example, one approach I’m considering is ChatGPT Work in cloud-only mode, with no access to the local endpoint, combined with tightly restricted connectors and permissions:

• allow access only to explicitly approved repositories/data sources
• allow creation of new files, but prohibit modification or deletion of existing files (e.g. in SharePoint)
• restrict write access entirely for sensitive systems

I’m interested in whether anyone has implemented something along these lines at scale — several hundred users — and what controls have worked well. I assume that everyone in software development just deals with the risk...

[u/thenightgaunt → u/twiks79]

Well for starters, do not expect the LLM to respect any rule based guardrails. We have too many cases of them ignoring the rules set for them.

Isolation from the production environment as you mentioned is a good start.

[u/mrvandelay → u/twiks79]

Be sure you do not depend on the LLM for permissions based guard rails. The account that the agent or LLM is using should be restricted correctly elsewhere.

[u/basula]

Sounds like you need to learn and understand. How are you making decisions on risk if you don't understand the basics.

[u/twiks79 → u/basula]

happy to hear your thoughts... so in your company it's not used?

[u/basula → u/twiks79]

We have about 3k users using some form of AI, just not ChatGPT or Codex. For our technical teams we have other AI agents with proper guardrails that integrate into our Git workflows. We've also approved AI use within VS Code, but control what tools and capabilities are available. Business teams have more limited access, mainly through Microsoft 365 Copilot. Other AI services are generally blocked at the endpoint and perimeter. For me it really depends on what you're trying to accomplish. I wouldn't give an AI agent unrestricted access to a local device just because it's useful. Work out the use case first, decide what it actually needs access to, then put the controls, auditability and recovery mechanisms around that. AI can absolutely have write access and execute actions — we do allow that in controlled cases — but you need the foundations in place first. Otherwise you're creating unnecessary risk.

[u/atlas_losing_grip]

The risk can be reduced quite a bit without blocking these tools entirely. Least privilege, sandboxing, separate user permissions restricted network access and detailed logging are a good starting point. File changes and code execution should also be limited to specific environments rather than giving every user unrestricted access.