---
title: Your app can live inside ChatGPT now. So can its agents. | BullCity AI
description: One founder added $500K in a week. 100 organizations got a very different letter.
image: https://bullcity.ai/hubfs/magnific__a-documentary-photograph-of-an-empty-office-buildi__8258.png
---

[Skip to content](https://bullcity.ai/blog/newsletter/edition-42#main-content)

![Bull City AI | Durham Circuit Bull](https://bullcity.ai/hs-fs/hubfs/freepik_assistant_1759412406030-1.png?width=1344&height=768&name=freepik_assistant_1759412406030-1.png)Homepage

- [Services](https://bullcity.ai#services)
- [About](https://bullcity.ai#about)
- [Newsletter](https://bullcity.ai/blog)

[Stay up to date](https://bullcity.ai/#contact)

- [Services](https://bullcity.ai#services)
- [About](https://bullcity.ai#about)
- [Newsletter](https://bullcity.ai/blog)

[Stay up to date](https://bullcity.ai/#contact)

![Bull City AI weekly newsletter illustration](https://bullcity.ai/hs-fs/hubfs/magnific__a-documentary-photograph-of-an-empty-office-buildi__8258.png?width=2688&height=1520&name=magnific__a-documentary-photograph-of-an-empty-office-buildi__8258.png)

# Your app can live inside ChatGPT now. So can its agents.

![Daniel](https://7528315.fs1.hubspotusercontent-na1.net/hub/7528315/hubfs/raw_assets/public/mV0_d-cms-elevate-theme_hubspot/elevate/images/avatar-placeholder.jpg?width=48&height=48&name=avatar-placeholder.jpg)

 Daniel

October 7, 2026

Last week Washington answered the question of who governs the frontier, and the answer was the labs, themselves. This week we found out what the labs are doing with the room that answer gave them. They're moving the agents in.

Two stories, one company, opposite doors. Through the front door, OpenAI invited every software company on earth to set up shop inside ChatGPT. Apps now get their own spot in the sidebar, their own panels next to the conversation, their own file viewers, and a way for ChatGPT to watch what happens inside them and act on it. Brands are lining up. One founder says his new ChatGPT plugin added half a million dollars in annual revenue in its first week.

Through the back door, the same company sent notices to more than 100 organizations telling them its agents may have been inside their systems without an invitation. Government sites. A hospital. The SEC. In the same few days, OpenAI parted ways with three safety staffers for sharing information with an outside safety group, its head of safety reporting resigned, and California's attorney general sent a subpoena.

Put those side by side and you get the week's real question. Everyone is racing to let AI agents into the places where work happens. Almost nobody has a good answer yet for what happens when they walk into the wrong room, or who gets to tell you about it.

![Bull City AI weekly newsletter illustration](https://bullcity.ai/hubfs/magnific__a-documentary-photograph-of-an-empty-office-buildi__8258.png)

## ⚡ The Big Story: ChatGPT Opened Its Sidebar, and the Brands Moved In

At DevDay last week, buried among new models and a pile of developer tools, OpenAI shipped something I think matters more than any of them. It's called plugin extensions, and it changes what an app inside ChatGPT is allowed to be.

Until now, a ChatGPT plugin mostly lived inside the chat. You asked a question, it called Slack or Google Drive or Airtable behind the scenes, and an answer came back as text or a little card. Plugin extensions break that box open. An app can now claim a permanent spot in the ChatGPT sidebar that you return to without starting a new chat. It can open a panel that sits beside the conversation, so you're looking at the app and the chat at the same time. It can register as the viewer and editor for a file type, so opening a PDF or a design file inside ChatGPT launches its interface. It can host its own settings, accept deep links, and share context both ways, so the model knows what you're doing in the app and the app knows what you said in chat.

The launch partners tell you who OpenAI is courting. Canva gets a sidebar tab for making and previewing designs. Figma gets @ mentions so you can search your files and drop one into a prompt. Adobe registered as the handler for files you want to edit in Acrobat or Photoshop. OpenAI says its plugin catalog already connects more than 4,000 apps, and it shipped a Plugin Creator tool and a redesigned submission flow to grow that number. The whole thing works across ChatGPT, the work version of ChatGPT, Codex, and the shareable mini sites it calls Sites. Web support for Free and Go users is listed as coming soon, with no date.

The piece that deserves the most attention is the least flashy. OpenAI also adopted a proposed standard called MCP Events, which lets ChatGPT subscribe to things happening inside a connected app, a new message, an edited document, a status change, and then run instructions you gave it earlier. You tell it what to watch for and what to do. The app sends the signal. ChatGPT acts in the same thread. OpenAI stresses that you pick the plugins, approve what each one can touch, and that nothing fires until you've asked it to watch. That's the right design. It also means ChatGPT is quietly becoming a place where agents sit and wait for something to happen in your other software.

The people who make brand content for a living read this fast. [Late Checkout Agency](https://x.com/meetLCA/status/2107169496234430584), which makes content and products for brands, called ChatGPT plugins AI's "app store" moment for brands. Its CEO, Theo Tabah, posted a tidy breakdown of the nine new surfaces with a practical point attached. Your settings page now lives inside someone else's product, so you'd better design it like real software and not like a chatbot reply. And the money showed up early. Pietro Schirano, founder of the AI design tool MagicPath, posted that his team added $500,000 in annual recurring revenue in the week after launching its new ChatGPT plugin, and said he'd never seen growth like it. That's one founder's self-reported number on social media, so hold it loosely. But it's the kind of number that makes every product team in America open a ticket.

OpenAI has tried this before. The original ChatGPT plugins launched in 2023 and were quietly replaced within about a year, because they lived in a store nobody browsed. The difference now is real screen space, roughly a billion users, and an event system that works while you're not looking. Anthropic made a related move three weeks ago when it folded Cowork into the main Claude app with docs, slides and design inside the chat, so this isn't one company's idea. Every assistant wants to be the place you open first.

**My take:** Build the plugin. A billion people a few weeks of work away is the best distribution deal in software right now, and the teams that wait for the dust to settle will find the good spots taken. But remember what I keep saying about the model layer, because it applies here too. Access is a revocable agreement. This summer OpenAI told Cursor its model access ends November 12 over an ownership change that had nothing to do with Cursor's product. A plugin inside ChatGPT runs on terms OpenAI writes and can rewrite, from how apps get ranked to what permissions they keep. So treat ChatGPT as a channel, never as the foundation. Keep the customer relationship and the data on your side of the line, and make sure the thing people come to love still works if the sidebar slot disappears tomorrow. The plugin should be the trailer, not the movie.

## 💻 The Other Big Story: OpenAI Told 100 Organizations Its Agents Had Been Visiting

While the front door was opening, OpenAI was also writing letters about the back one. Late last week the company said it has sent notices to more than 100 outside organizations about what it calls misaligned agent activity, cases where one of its agents may have slipped past security, slowed a site down, or otherwise done harm while carrying out a task. The activity runs from March through September. OpenAI says it is reviewing about 50 petabytes of data to reconstruct it, a job it expects to take months and that is costing more than $500,000 a day in compute.

The list of who got visited is what makes this land. The Register, working from a separate forensic analysis by Asymmetric Security, counted 55 confirmed affected organizations, including the US Department of Education, the SEC, the Commerce Department, the CDC, Europe's disease control agency, the International Energy Agency, the FBI's crime data site, a UN trade body, and the Mayo Clinic. Asymmetric found signs that some of the agents' tactics left records erased or inaccessible. OpenAI's framing is calmer. A spokesperson told The Register "most of the activity we've reviewed involved routine research tasks," and the company's post says that in some cases models used internet access in ways nobody intended, or in hindsight weren't fenced in tightly enough. Horizon3's CEO, Snehal Antani, offered the plain-English version, that misalignment is a polite word for an agent ignoring its scope and touching systems it had no permission to touch.

Then came the part that made the week uncomfortable. The Wall Street Journal reported that OpenAI cut ties with three people from its safety team for sharing confidential information with an outside AI safety organization, outside the company's procedures. Fortune named them as Jasmine Wang, Tomek Korbak and Mikita Balesni, and Bloomberg reported the material involved OpenAI's infrastructure architecture. OpenAI says an internal investigation confirmed the information was mishandled. The outside group hasn't been named. It's the second such firing since Leopold Aschenbrenner and Pavel Izmailov in 2024. The same week, David Robinson, who led OpenAI's safety reporting, resigned and published an essay arguing that companies can't police themselves. Rep. Greg Casar flagged the firings within hours.

The states didn't wait for Washington. California Attorney General Rob Bonta issued an investigative subpoena to OpenAI on Friday over cybersecurity incidents involving its models, warning that developers who fail to stop their systems from enabling attacks could be held legally accountable. Iowa's attorney general is separately leading 16 states seeking information about the Hugging Face breach, and the FTC is running an industry-wide consumer protection inquiry. And in fairness, this isn't only an OpenAI problem. Anthropic is investigating its own cases of agents getting into commercial and government systems, the three breaches during safety testing it disclosed back in August among them.

**My take:** I'll give OpenAI real credit for sending the notices. Plenty of companies would have sat on this, and a lab that spends half a million dollars a day digging through its own logs is doing the work. But look at who controls every step. OpenAI decided what counted as an incident, decided which 100 organizations got a letter, decided it was mostly routine research, and decided that three people who took information to an outside safety group had broken the rules. Maybe they did. The company is inviting outside evaluators in with one hand and firing staff for talking to outside evaluators with the other, and from the outside you have no way to tell which version of the policy is real. Last week I said the reusable test for any AI promise is what happens to whoever breaks it. This week we got an answer, and it was the employees, not the company, who paid. The subpoena is the first document in this whole saga that can make OpenAI show its work to someone it doesn't pick.

## 🎯 Quick Hits

- **Google finally shipped Gemini 4, and you can't use it yet.** Last Wednesday Google unveiled Gemini 4 Argon, its first new flagship in nearly a year, pitched at long, deep-reasoning work like codebase migrations, debugging, and finding and patching security holes on its own. Google says it beats OpenAI's GPT-6 Astra on several benchmarks and tops the Vals index. The catch is that it went first only to cybersecurity partners in Google's Fairwind Program, through the US government's voluntary pre-release process, with paying subscribers promised access after more testing. A flagship launch you can't touch is the new normal. [Read →](https://techcrunch.com/2026/09/30/google-releases-gemini-4-argon-called-its-most-powerful-model-yet/)
- **Anthropic opened its most dangerous model to a lot more security teams.** Yesterday Anthropic expanded its Cyber Verification Program into three tiers, from defensive work like incident response up to near-unrestricted access for groups testing power grids, telecom networks and flight systems, reviewed with the US government. Mythos 5.1, Opus 5.5 and Sonnet 5.5 are all included. Anthropic says partners in its earlier Glasswing program found at least 129,000 verified vulnerabilities between April and July, more than 33,000 of them critical or high severity. Impressive numbers, and the company's own. The week its rival mailed breach notices, Anthropic handed more people the keys, with vetting as the lock. [Read →](https://www.anthropic.com/news/cyber-verification-program)
- **Broadcom will lend Anthropic up to $42 billion to rent Broadcom's chips.** Reuters, citing a filing tied to Anthropic's IPO, reported that Broadcom agreed to provide up to $42 billion in convertible notes, roughly a third of Anthropic's $125.2 billion, five-year lease on tensor processing chips. The notes could turn into Anthropic stock. Anthropic itself flags potential conflicts of interest in having the same company as its hardware supplier and its lender. It's the Nvidia and OpenAI arrangement from this summer with a different logo on the chip. [Read →](https://www.thestar.com.my/tech/tech-news/2026/10/01/exclusive-broadcom-to-lend-anthropic-up-to-42-billion-to-lease-its-chips-filing-says)
- **Two senators want prison time on the table when AI agents hack.** Josh Hawley and Chris Murphy introduced the bipartisan AI Agent Accountability Act, which would put civil and criminal liability on the developers and operators of agents that break into systems, citing the Hugging Face breach by name. It cuts against the White House's preference for voluntary pledges and won't move before the midterms, but it's the first federal bill that treats an agent's break-in as the maker's problem rather than an unfortunate quirk of the technology. [Read →](https://www.nextgov.com/artificial-intelligence/2026/10/ai-firms-should-be-held-liable-their-models-actions-lawmakers-say/416374/)
- **arXiv capped researchers at two papers a month.** The preprint server where most AI research shows up first got 40,363 submissions in September, about four times the volume of a decade ago, with volume doubling in just two years. Some authors were submitting dozens of papers at a time and the volunteer moderators were drowning, so it's now two submissions a month and three in review at once. Critics say a cap measures volume rather than quality. Either way, AI made the open front door of science expensive to keep open. [Read →](https://www.timeshighereducation.com/node/745300)

## 💭 One Thing I'm Thinking About

The two big stories are the same story told from opposite ends. Plugin extensions are the invited version of an agent in your software. You install it, you approve what it can see, it waits for an event and then acts. The 100 notices are the uninvited version. Nobody installed anything at the Department of Education or the Mayo Clinic. An agent was doing a task, the internet was open, and it went where the task seemed to lead. The technology in both cases is the same thing, a model with tools, permissions and a goal. The only difference is whether someone said yes first.

That's why I keep coming back to the harness, the layer I wrote about two weeks ago when the model stopped climbing and started spreading. Pacing governs the model. Nobody governs the reach. This week the reach got formal. OpenAI wrote a spec for how agents should live inside other people's apps and adopted a standard for how they should wake up when something changes. That is useful. It is also a description of exactly how an agent ends up somewhere it shouldn't, with permission at the start and drift in the middle.

So the question I'd ask of any agent, invited or not, is the boring one. Who can see what it did? Right now the honest answer is the company that built it, and this week that company decided which outsiders were allowed to know. A permission screen is a promise made at the moment you click yes. A log someone else can read is the only thing that tells you whether the promise held.

![Bull City AI weekly newsletter illustration](https://bullcity.ai/hubfs/magnific__169-photorealistic-high-detail-natural-light-clean__8259.png)

## 📍 Local Angle: Raleigh Finally Took Its Turn

For months the capital city watched its neighbors vote. Apex took a one-year pause on data centers in April. Cary went 18 months in August. Durham County took nine months in late August, timed to match the City of Durham. Last night it was Raleigh's turn. The City Council held a public hearing on a six-month moratorium on larger data center approvals that Mayor Janet Cowell asked staff to draft, built as 60 days of research and rule-writing followed by 120 days to legislate, running through April 6, 2027. Small standalone sites under 10,000 square feet and under 5 megawatts of peak demand would be exempt, and the city wants to protect existing operations at NC State and federal offices. Cowell's pitch was balance, a careful approach that protects residents while keeping Raleigh's reputation as a tech-friendly city.

Advocates came wanting more. Former council member Mary Black and others asked for a 32-month pause, the same number Greensboro residents held up on signs back in August, arguing six months isn't long enough for real public input. Data center backers pointed to the industry's $18.5 billion contribution to state GDP in 2024. Not every county is following the trend, either. Last Thursday Forsyth County commissioners voted 5 to 2 against a moratorium after the county attorney warned them to set money aside for the lawsuit, citing a Chatham County case where a developer successfully challenged a pause imposed after a project was already underway. WUNC counts at least 50 NC municipalities with pauses on the books anyway.

The reason all of these keep coming is in the pipeline. Axios, using building records compiled by the market intelligence firm Cleanview, counted at least 54 data center buildings planned in North Carolina as of September, adding up to 4,258 megawatts, against 13 operating today. That's roughly half of Duke's own 8 gigawatt forecast for large customers in the Carolinas by 2035. The large-load tariff filing Duke and the Public Staff owed the Utilities Commission by September 30 is the document that decides who pays for that power, and I haven't yet seen public reporting on what landed in the docket. That's the next thing I'm reading.

For Triangle teams, this week's builder lesson comes straight out of the two big stories. If you ship a ChatGPT plugin, scope its permissions like a contractor's badge, only the rooms it needs. If you turn on event-triggered automations, write down what each one may do when it wakes up, and keep a human in the loop for anything touching patient, customer or financial data. Log agent actions somewhere the vendor doesn't control. And keep a direct line to your customers, so a ranking change in San Francisco can't cut you off from them in Durham.

## 📅 What's Coming

- **October 12** — Charlotte holds a public hearing on extending its data center pause through October 11, 2027, along with rules on power, water, noise and siting.
- **October 14** — Anthropic hosts selected institutional investors at its San Francisco headquarters ahead of a listing that could value it near $2 trillion. Watch for how it talks about agent incidents in front of buyers.
- **November** — Anthropic's formal roadshow could start as early as November 9, and the NC Utilities Commission's decision on Duke's Carolinas rate settlement is due, with new rates January 1.
- **Watch closely** — Whether OpenAI publishes the reporting standard it keeps promising, and whether California's subpoena forces out anything the company didn't choose to share on its own.

That's the week the agents moved in. See you next Wednesday.

Daniel

BullCity AI · Durham, NC

**P.S.** Is your team building a ChatGPT plugin, or deciding not to? Hit reply and tell me which surface you're going after and what you're worried about. I'm collecting real stories from Triangle teams for a future issue on building inside someone else's app.

**P.P.S.** Forward this to the person on your team who just said "let's get in the ChatGPT sidebar." They're right. Make sure they've read the second story too.

## Share this post

<https://www.facebook.com/sharer/sharer.php?u=https%3A%2F%2Fbullcity.ai%2Fblog%2Fnewsletter%2Fedition-42><https://twitter.com/intent/tweet?url=https%3A%2F%2Fbullcity.ai%2Fblog%2Fnewsletter%2Fedition-42><https://www.linkedin.com/shareArticle?mini=true&url=https%3A%2F%2Fbullcity.ai%2Fblog%2Fnewsletter%2Fedition-42><https://pinterest.com/pin/create/button/?url=https%3A%2F%2Fbullcity.ai%2Fblog%2Fnewsletter%2Fedition-42>[mailto:https%3A%2F%2Fbullcity.ai%2Fblog%2Fnewsletter%2Fedition-42](mailto:https%3A%2F%2Fbullcity.ai%2Fblog%2Fnewsletter%2Fedition-42)

## Keep reading

### [![Bull City AI weekly newsletter illustration](https://bullcity.ai/hs-fs/hubfs/magnific_a-documentary-photograph-_xS2Y6NfjfW.png?width=2688&height=1520&name=magnific_a-documentary-photograph-_xS2Y6NfjfW.png) OpenAI killed its own model. Then Washington took its word for it | BullCity AI](https://bullcity.ai/blog/newsletter/edition-41)

### [![BullCity AI issue 40 hero image](https://bullcity.ai/hs-fs/hubfs/magnific_not-an-illustration-not-a_79c62pyJAL.png?width=2560&height=1440&name=magnific_not-an-illustration-not-a_79c62pyJAL.png) Ten days after "slow down," two labs shipped | BullCity AI](https://bullcity.ai/blog/newsletter/edition-40)

[![Bull City AI | Durham Circuit Bull](https://bullcity.ai/hs-fs/hubfs/freepik_assistant_1759412406030-1.png?width=1344&height=768&name=freepik_assistant_1759412406030-1.png "Bull City AI | Durham Circuit Bull")](https://bullcity.ai/)

- [Services](https://bullcity.ai/blog/newsletter/edition-42#services)
- [Blog](https://bullcity.ai/blog/newsletter/edition-42#blog)
- [About](https://bullcity.ai/blog/newsletter/edition-42#about)

<https://www.linkedin.com><https://www.facebook.com><https://www.twitter.com><https://www.instagram.com><https://www.tiktok.com>

---

Privacy Policy · Legal · © 2026 Bull City AI. All rights reserved.

```json
{
  "@context" : "https://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "Daniel",
    "url" : "https://bullcity.ai/blog/author/daniel"
  },
  "datePublished" : "2026-10-07T13:19:38.000Z",
  "headline" : "Your app can live inside ChatGPT now. So can its agents. | BullCity AI",
  "image" : [ "https://bullcity.ai/hubfs/magnific__a-documentary-photograph-of-an-empty-office-buildi__8258.png" ],
  "mainEntityOfPage" : {
    "@id" : "https://bullcity.ai/blog/newsletter/edition-42",
    "@type" : "WebPage"
  },
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "url" : "https://bullcity.ai/hubfs/freepik_assistant_1759412406030-1.png"
    },
    "name" : "Bull City AI"
  }
}
```