Best AI Agent Security Software for ChatGPT Workspace Agents
Try it live
Watch AgentShield block an attack in real time.
Pick a scenario and drive the inspection lane yourself. No signup needed.
Run a request
Runs the live engine on your text. Nothing is stored, no account needed.
Inspection lane
INSPECTINGPolicy trace
High-risk action held for approval
Audit trail
- § · → → →
The best security setup for ChatGPT workspace agents is usually OpenAI's own workspace controls, your existing SIEM fed by the Compliance Logs Platform, and service accounts for every shared connection. You only need to buy something extra when your agents call custom MCP servers that write to systems of record, or when you need one inventory across several agent platforms. Browser and endpoint tools, the usual first purchase for "ChatGPT security", do not see these agents at all, because workspace agents run in the cloud.
That last point is where most shortlists go wrong. For two years, securing ChatGPT meant watching what employees pasted into a browser tab. Workspace agents, released in research preview on April 22, 2026 for Business, Enterprise, Edu and Teachers plans, are a different object. They run on a schedule, answer in Slack channels, start from an API call, and act through whichever connection their builder configured. OpenAI's help center puts the core risk in one sentence: "Anyone who can use the agent may be able to access data or perform actions through those connections as the creator."
So the buying question is not "which ChatGPT security tool". It is which of three specific gaps you actually have: who an agent acts as, what it may do in your own systems, and whether you can prove afterward what it did.
Why this is a buying decision now
Two dates put workspace agents on security's desk this quarter. Workspace agents are off by default for ChatGPT Enterprise workspaces, so every rollout starts with an admin decision that someone has to sign. And OpenAI's Agent Builder shuts down on November 30, 2026, with workspace agents named as one of its two destinations, so teams are rebuilding flows right now, often faster than anyone is reviewing them. If you are in the middle of that move, our OpenAI Agent Builder shutdown page covers what does not carry over.
The AgentForger research made the stakes concrete. Zenity Labs showed that a crafted link could get ChatGPT's agent builder to create an attacker controlled workspace agent with the victim's own connectors. OpenAI fixed it on June 8, 2026, before the public write-up. The pattern it exposed has not gone away: in this product, an agent inherits the reach of its connections, and connections tend to be broader than any one task needs.
Six options compared
This table covers what each option sees, where it goes blind, and what it costs you in new spend. We sell the last row, and we have tried to be as fair to the other five as we would want a competitor to be to us.
| Option | What it covers | Blind spot | New spend | Best for |
|---|---|---|---|---|
| OpenAI workspace controls | RBAC for build and publish, read only or custom app actions, write approvals that default to Always ask, Connector Action Constraints | Constraints "do not filter or restrict the data a connector returns". No agent specific budget caps | None, included in the plan | Every deployment, first |
| Compliance Logs Platform into your SIEM | Immutable JSONL logs of runs, connector calls, triggers and memory events | After the fact, roughly 10 minute windows with p99 under 30 minutes | None if you already run a SIEM | Detection, investigations, audit evidence |
| Service accounts and your identity provider | Narrow credentials behind every agent owned connection | Scopes drift as builders add workflows | None, you own the IdP | Slack deployed and scheduled agents |
| Agent governance platform (for example Zenity) | Inventory, posture and policy across ChatGPT Enterprise and other agent platforms, through the Compliance API | Broad coverage across platforms. Ask whether it enforces your business rules on custom MCP calls or reports on them | A new platform contract | Several agent platforms, one governance team |
| Browser security or endpoint DLP | What employees paste or upload in a browser session | Does not see cloud runs, so scheduled, Slack and API triggered agents are invisible to it | Often already owned | Interactive ChatGPT use, not agents |
| Runtime policy gateway on custom MCP (AgentShield) | Per tool and per argument policy, approvals, injection inspection of tool results, a record per call | Does not sit on OpenAI managed connectors such as Gmail, Drive or Slack | A new subscription | Custom MCP servers that write to CRM, billing or ticketing |
Three of those six rows cost nothing new. That is not modesty on our part, it is how this product is built. OpenAI governs the traffic that stays inside its platform, and it does a reasonable job. Zenity has integrated with the ChatGPT Enterprise Compliance API since April 2025, and if your problem is a governance team looking after Copilot Studio, Agentforce and ChatGPT at once, it is a serious option; we compare it on our Zenity alternatives page.
Which of them you actually need
Sort your agents by what they do, not by which department built them. Three profiles cover almost every workspace we have looked at.
Agents that read and summarize
A weekly digest of a shared drive, a meeting follow up drafted for a person to send, a research brief. Set the relevant apps to read only, keep connections on end user accounts, and ship. Buy nothing. A gateway here adds latency and a contract for no risk reduction.
Agents in Slack or on a schedule that use managed apps
Slack forces shared connections, because Slack cannot pause a run to sign in each person, so everyone in the channel acts as the connection owner. The controls that matter are service accounts scoped to one workflow, employee only channels, write approvals left on Always ask, and the compliance log streaming into your SIEM with alerts on new published agents. OpenAI's own security overview says admins "should define review, approval, rollback, and incident-response expectations before broad rollout", and the incident part is the one teams skip. Someone has to be reachable when a scheduled agent posts the wrong file at 9 AM on a Monday; if you have no rotation yet, incident management software that pages the right engineer is a cheaper fix than any AI security product.
Agents that call custom MCP servers into systems of record
This is where the built-in controls run out. A builder adds your CRM or billing system as a custom MCP server, and from that point the most consequential actions the agent takes happen on your infrastructure. OpenAI sees a tool call. It does not know that updates are fine for records the invoking user owns and a bulk export of the whole pipeline is not. That rule has to be enforced where the call lands, which is what an MCP gateway does, and it is the case our ChatGPT workspace agents security page is built around.
Questions to ask any vendor before you buy
- Does your product see scheduled, Slack and API triggered runs, or only browser sessions? If the answer is browser only, it does not cover workspace agents.
- Can you enforce a decision before a tool call executes, or only report it afterward? Both are useful. They are different products.
- How do you tell the invoking user from the connection owner when an agent runs on a shared connection?
- Do you inspect what a tool returns, not just what the agent sends? Returned email and document content is where injected instructions arrive.
- Where does your evidence live, and can it join the OpenAI compliance log in our SIEM on a shared run or request identifier?
A vendor that answers the first two clearly in a first call is worth a pilot. The fourth question is the one that separates products built for agents from products built for chat.
Do I need extra security software for ChatGPT workspace agents?
Not always. If your workspace agents only read and summarize content from managed apps like Drive or SharePoint, OpenAI's workspace controls plus your SIEM are enough. You need more when agents run on shared connections at scale, or when they call custom MCP servers that can change records in your own systems, because OpenAI cannot apply your business rules to those calls.
Can DLP or browser security see ChatGPT workspace agents?
Mostly no. Endpoint DLP and browser security tools inspect what a person types, pastes or uploads in a browser session. Workspace agents run in OpenAI's cloud, so a scheduled run, a Slack mention or an API triggered run never passes through the employee's browser. For those, your evidence is the Compliance Logs Platform and whatever enforcement you put in front of your own MCP servers.
If your agents are heading toward custom MCP tools that can change money, customers or records, start with per tool permissions and the workspace agents security controls that go with them. You can watch the policy engine decide a live tool call in the console at the top of this page.
See the firewall block an attack live.
Drive the Threat Console and watch a real prompt injection get stopped, then put AgentShield in front of your own agents.