ChatGPT Enterprise crossed a meaningful line inside Slack on June 22, 2026. With a connector update rolling out to Enterprise and Edu workspaces, OpenAI’s assistant can now take actions inside Slack \u2014 joining channels, creating reminders, uploading files, and updating user profiles \u2014 not merely search and summarize them. For every organization running both platforms, that is the moment ChatGPT became a write-access agent inside their primary communication infrastructure, and the security and governance implications are distinct from anything the read-only connector raised.<\/p>\n
The distinction matters because the underlying permission architecture is categorically different. The previous Slack connector operated exclusively through read-access OAuth scopes \u2014 the authentication tokens it held allowed it to retrieve channel data, search messages, and read conversation history, but they carried no authority to modify anything. The new connector actions require a separate set of OAuth 2.0<\/a> write-scope tokens: channels:join to enter a channel, files:write to upload documents, reminders:write to create reminders, and users.profile:write to update a user’s Slack profile. An admin who enables these write actions is not simply expanding what ChatGPT can see \u2014 they are granting it a fundamentally different class of authority over Slack’s infrastructure.<\/p>\n What ChatGPT Can Now Do in Slack<\/p>\n From a single ChatGPT prompt, an Enterprise user can now ask the assistant to create a reminder for a Monday standup, upload a project document to a team channel, join a channel the agent needs access to, and update their Slack status \u2014 without opening Slack directly. The assistant handles each step as a sequence of API calls against Slack’s Web API, translating natural language into the specific POST requests that the platform’s backend executes. This is the operational definition of an agentic workflow: the model is not generating text for a human to act on, it is itself acting on the human’s behalf inside live infrastructure.<\/p>\n For large Enterprise Grid deployments \u2014 the tier that governs Slack across multiple corporate workspaces \u2014 some of the new write-scope actions require approval from an Enterprise Grid administrator, not merely a workspace administrator. OpenAI’s release notes<\/a> state that “some actions may require additional Slack OAuth scopes or approval from a Slack workspace or Enterprise Grid admin,” meaning rollout at the largest corporate Slack customers is gated behind a higher-trust approval chain.<\/p>\n Why Write Access Changes the Security Calculus<\/p>\n The read-to-write transition is where the security picture changes in kind, not just in degree. When ChatGPT could only read Slack, a successful prompt injection attack \u2014 a technique in which malicious instructions hidden inside a document, message, or email cause the AI to follow the attacker’s commands rather than the user’s \u2014 could expose data. When ChatGPT can write Slack, the same attack can execute actions: join unauthorized channels, upload files containing harvested data, or modify user profiles in ways that facilitate social engineering.<\/p>\n This is not theoretical. Radware<\/a> security researchers documented a related vulnerability in 2025, disclosing to OpenAI a flaw they called ShadowLeak, in which malicious instructions embedded in a Gmail message could cause a ChatGPT connector to transmit a user’s password to an attacker-controlled server without any user interaction. Zvika Babo, Radware’s threat researcher, confirmed the details in a blog post shared with The Register. OpenAI patched that specific flaw in December 2025, but the underlying architecture \u2014 an AI agent that reads external content and takes actions based on what it reads \u2014 remains a class of vulnerability that the UK’s National Cyber Security Centre<\/a> has stated prompt injection attacks against AI agents “may never be totally mitigated.”<\/p>\n OpenAI has been direct about this. The company stated publicly that prompt injection “is unlikely to ever be fully ‘solved,'” and that agent mode “expands the security threat surface.” That statement predates this week’s update, which expands the agent’s surface inside one of the world’s most widely used enterprise communication platforms.<\/p>\n How the Permission Architecture Works<\/p>\n Understanding what Action Control actually does requires understanding how Slack’s OAuth 2.0 scope system works. When an admin enables the ChatGPT Slack connector, they complete an OAuth flow authorizing a set of permission scopes \u2014 the specific categories of action the token is permitted to take. These scopes are determined at authorization time and, critically, cannot be downgraded without revoking the entire token. As Slack’s own API documentation<\/a> states, it is not possible to reduce the scopes attached to an active access token; only full revocation and re-authorization can remove permissions once granted.<\/p>\n This means the Action Control panel<\/a> that OpenAI has built into Workspace Settings is not merely a governance convenience \u2014 it is the primary mechanism preventing a one-time OAuth approval from becoming open-ended write delegation. Admins can use Action Control to specify which write-scope actions ChatGPT is permitted to exercise, choose whether to allow all actions, read-only actions, or a custom subset, and determine how newly added actions in the future will be handled.<\/p>\n The practical implication: an admin who approves the full write-scope OAuth flow but configures Action Control to allow only read actions has granted the token the technical authority to write, but instructed ChatGPT not to exercise it. That is a software-layer restriction, not an authorization-layer one. If Action Control settings are changed later, the underlying OAuth permission is already in place.<\/p>\n Timing: 40 Days Before a Major Compliance Deadline<\/p>\n The update arrives as enterprise AI governance is entering its most consequential regulatory period to date. The European Union’s AI Act<\/a> becomes fully applicable on August 2, 2026 \u2014 40 days from publication. Among its requirements: AI systems that act on a user’s behalf must identify themselves as AI at the moment of action. A connector that previously only retrieved information now takes actions, which means its compliance posture under the AI Act changes on the same day its write-access capability rolls out.<\/p>\n