ChatGPT plugins gave the chat window a way to call outside tools

The conversation

On 23 March 2023, OpenAI said in its own announcement that it had implemented "initial support for plugins in ChatGPT," letting the chat product call outside tools instead of relying only on the model's training data. Access opened through a waitlist, and the initial partner list named in the announcement includes Expedia, Instacart, Klarna, Milo, OpenTable, Shopify, Slack, Speak, Wolfram and Zapier. OpenAI also built two plugins of its own: a web browsing plugin and an open-source retrieval plugin, both meant to demonstrate the pattern rather than compete with third-party builders.

What the documents show

The announcement states that a plugin is defined by a manifest file, hosted on the developer's own server, that points to an OpenAPI specification describing the plugin's calls and adds, in the announcement's own words, "some plugin-specific metadata." That documentation, captured by the Internet Archive on the day of launch, shows OpenAI describing the browsing plugin as retrieving content "using the Bing search API" while the plugin "operates within an isolated service," and the retrieval plugin as letting ChatGPT "search a vector database of content" that a developer or organization supplies. OpenAI published a working version of that second plugin the same day in its own reference repository, released under the MIT License, giving developers runnable code rather than only a specification.

The system boundary

The announcement scopes the browsing plugin to "retrieving information" and treats "transactional" capabilities such as purchases as a distinct, separate area for security and safety work. Access was staged rather than universal: OpenAI states it would "initially prioritize a small number of developers and ChatGPT Plus users" before a "larger-scale" rollout, so a developer still on the waitlist could not install a manifest at all, and a free ChatGPT account could not reach any plugin regardless of waitlist status. The retrieval plugin's authorization boundary sits with whoever runs it: the documentation states a developer "should only add content into their retrieval plugin that they are authorized to use and can share," so the protocol checks nothing beyond what that developer builds.

Where it fails

The manifest model asked each developer to expose an OpenAPI-documented service and trust ChatGPT to decide when to call it, which put moderation, rate limits and authentication in that developer's own hands rather than a shared framework. OpenAI's own description of browsing as introducing "certain classes of safety risks" that its design "reduces (but does not eliminate)" is a vendor's own acknowledgment, worth keeping in view whenever a later interface claims to have solved the same problem outright.

• Does a tool-calling interface state who is responsible for a called service's content and behavior?
• Is a stated safety boundary, such as retrieval rather than transactions, enforced by the platform or only by convention?
• What happens to an installed integration once a platform's own extension model is later retired?

Plugins were OpenAI's first attempt at letting ChatGPT act outside the chat window, and the announcement's own limits, a waitlist, a Plus-first rollout and a manual manifest, describe a beta built to be superseded, which OpenAI's later documentation confirms it was.