ChatGPT Enterprise crossed a meaningful line inside Slack on June 22, 2026. With a connector update rolling out to Enterprise and Edu workspaces, OpenAI’s assistant can now take actions inside Slack — joining channels, creating reminders, uploading files, and updating user profiles — not merely search and summarize them. For every organization running both platforms, that is the moment ChatGPT became a write-access agent inside their primary communication infrastructure, and the security and governance implications are distinct from anything the read-only connector raised.

The distinction matters because the underlying permission architecture is categorically different. The previous Slack connector operated exclusively through read-access OAuth scopes — the authentication tokens it held allowed it to retrieve channel data, search messages, and read conversation history, but they carried no authority to modify anything. The new connector actions require a separate set of OAuth 2.0 write-scope tokens: channels:join to enter a channel, files:write to upload documents, reminders:write to create reminders, and users.profile:write to update a user’s Slack profile. An admin who enables these write actions is not simply expanding what ChatGPT can see — they are granting it a fundamentally different class of authority over Slack’s infrastructure.

What ChatGPT Can Now Do in Slack

From a single ChatGPT prompt, an Enterprise user can now ask the assistant to create a reminder for a Monday standup, upload a project document to a team channel, join a channel the agent needs access to, and update their Slack status — without opening Slack directly. The assistant handles each step as a sequence of API calls against Slack’s Web API, translating natural language into the specific POST requests that the platform’s backend executes. This is the operational definition of an agentic workflow: the model is not generating text for a human to act on, it is itself acting on the human’s behalf inside live infrastructure.

For large Enterprise Grid deployments — the tier that governs Slack across multiple corporate workspaces — some of the new write-scope actions require approval from an Enterprise Grid administrator, not merely a workspace administrator. OpenAI’s release notes state that “some actions may require additional Slack OAuth scopes or approval from a Slack workspace or Enterprise Grid admin,” meaning rollout at the largest corporate Slack customers is gated behind a higher-trust approval chain.

Why Write Access Changes the Security Calculus

The read-to-write transition is where the security picture changes in kind, not just in degree. When ChatGPT could only read Slack, a successful prompt injection attack — a technique in which malicious instructions hidden inside a document, message, or email cause the AI to follow the attacker’s commands rather than the user’s — could expose data. When ChatGPT can write Slack, the same attack can execute actions: join unauthorized channels, upload files containing harvested data, or modify user profiles in ways that facilitate social engineering.

This is not theoretical. Radware security researchers documented a related vulnerability in 2025, disclosing to OpenAI a flaw they called ShadowLeak, in which malicious instructions embedded in a Gmail message could cause a ChatGPT connector to transmit a user’s password to an attacker-controlled server without any user interaction. Zvika Babo, Radware’s threat researcher, confirmed the details in a blog post shared with The Register. OpenAI patched that specific flaw in December 2025, but the underlying architecture — an AI agent that reads external content and takes actions based on what it reads — remains a class of vulnerability that the UK’s National Cyber Security Centre has stated prompt injection attacks against AI agents “may never be totally mitigated.”

OpenAI has been direct about this. The company stated publicly that prompt injection “is unlikely to ever be fully ‘solved,'” and that agent mode “expands the security threat surface.” That statement predates this week’s update, which expands the agent’s surface inside one of the world’s most widely used enterprise communication platforms.

How the Permission Architecture Works

Understanding what Action Control actually does requires understanding how Slack’s OAuth 2.0 scope system works. When an admin enables the ChatGPT Slack connector, they complete an OAuth flow authorizing a set of permission scopes — the specific categories of action the token is permitted to take. These scopes are determined at authorization time and, critically, cannot be downgraded without revoking the entire token. As Slack’s own API documentation states, it is not possible to reduce the scopes attached to an active access token; only full revocation and re-authorization can remove permissions once granted.

This means the Action Control panel that OpenAI has built into Workspace Settings is not merely a governance convenience — it is the primary mechanism preventing a one-time OAuth approval from becoming open-ended write delegation. Admins can use Action Control to specify which write-scope actions ChatGPT is permitted to exercise, choose whether to allow all actions, read-only actions, or a custom subset, and determine how newly added actions in the future will be handled.

The practical implication: an admin who approves the full write-scope OAuth flow but configures Action Control to allow only read actions has granted the token the technical authority to write, but instructed ChatGPT not to exercise it. That is a software-layer restriction, not an authorization-layer one. If Action Control settings are changed later, the underlying OAuth permission is already in place.

Timing: 40 Days Before a Major Compliance Deadline

The update arrives as enterprise AI governance is entering its most consequential regulatory period to date. The European Union’s AI Act becomes fully applicable on August 2, 2026 — 40 days from publication. Among its requirements: AI systems that act on a user’s behalf must identify themselves as AI at the moment of action. A connector that previously only retrieved information now takes actions, which means its compliance posture under the AI Act changes on the same day its write-access capability rolls out.

Separately, the US National Institute of Standards and Technology launched a dedicated initiative in February 2026 to develop standards specifically for autonomous AI agents — covering agent identity, action logging, and containment boundaries. The initiative was a direct response to the governance challenges that agentic systems have created at production scale. Organizations enabling ChatGPT’s new write-access Slack capabilities ahead of those standards being finalized are doing so without a settled compliance framework.

OpenAI’s Enterprise Platform Strategy

The Slack write-action capability is not an isolated feature — it is a brick in a structure OpenAI has been assembling systematically. Earlier expansions brought write-access agent capabilities to Microsoft Outlook email drafting, Google Docs creation, and calendar management. The company introduced Workspace Agents in April 2026, which can run on schedules and execute multi-step workflows across connected tools without continuous user supervision. The Slack connector actions announced this week follow the same architectural pattern: expand the scope of what the agent is authorized to do, provide an admin control layer, and make the expanded capability available inside the interfaces where enterprise workflows already run.

The competitive context sharpens the strategic picture. On the same day as this article’s publication, Anthropic released Claude Tag, a competing Slack-native AI agent that accumulates institutional channel knowledge over time and executes asynchronous multi-step tasks. OpenAI and Anthropic are both converging on Slack as the surface where enterprise AI adoption decisions will be made — and both are betting that users who delegate tasks through Slack are more likely to stay than users who interact through standalone AI interfaces.

What Administrators Should Do Before Enabling Write Actions

Write actions are disabled by default in the ChatGPT Slack connector; administrators must deliberately enable them in Workspace Settings under Apps. Before doing so, OpenAI recommends reviewing the specific OAuth scopes each action requires, since some scopes need additional approval from a Slack workspace administrator or an Enterprise Grid administrator. Organizations with large or complex Slack deployments, or those operating in regulated industries subject to EU AI Act compliance requirements, should audit their existing Slack permission configurations before expanding ChatGPT’s authorization tier.

The Compliance API remains available for Enterprise and Edu accounts, providing access to conversation logs from ChatGPT’s Slack interactions for audit and governance purposes. That audit trail matters more with write actions enabled: an agent that can modify the environment leaves a record that needs to be reviewed, not just the conversations that prompted it.

Frequently Asked Questions

What new Slack actions did ChatGPT Enterprise gain in the June 2026 update?

The June 22 update added the ability for ChatGPT Enterprise and Edu workspaces to use Slack connector actions, including joining a channel, creating a reminder, uploading a file, and updating a user’s Slack profile. These are write-scope actions distinct from the previous read-only connector, which could search and summarize Slack content but could not modify anything.

Are ChatGPT’s new Slack write actions enabled by default?

No. Write actions are disabled by default for all ChatGPT Enterprise and Edu workspaces. Administrators must explicitly enable them in Workspace Settings under Apps, and must configure Action Control to specify which actions are permitted. Some actions also require additional OAuth scope approval from a Slack workspace administrator or Enterprise Grid administrator.

How does the OAuth permission architecture affect the security of ChatGPT’s Slack write access?

Slack’s OAuth 2.0 scope system does not allow permissions to be selectively removed from an active token — once write scopes are authorized, they cannot be downgraded without revoking the entire token and re-authorizing. The Action Control panel in ChatGPT workspace settings is a software-layer restriction that governs which write scopes ChatGPT chooses to exercise, but the underlying OAuth authorization persists. Admins should treat Action Control configuration as a security-critical step, not an optional governance convenience.

Is the ChatGPT Slack connector update available for standard ChatGPT plans?

No. The Slack connector actions are available only to ChatGPT Enterprise and Edu workspaces. Standard ChatGPT plans, including Plus, Pro, and Business, do not receive these write-action capabilities in this update.