OpenAI's team sites use each person's connectors; one demo had an agent search Slack DMs

At OpenAI's DevDay 2026 session on Sites, presenters showed two features that widen what an agent can reach. On private team sites, teammates can bring their own ChatGPT plugins, so the site fetches data through each person's connectors. Separately, a visitor's own agent can call a site's tools, and one demo had it search Slack direct messages. The speakers are not named.

What was said

Teammates who sign in to a private site can bring their plugins, and the site can reach their data in Drive, Slack and Linear. In the demo, two presenters opened one site and each saw their own Linear tickets. The builder's Codex prompt asked for the Linear connector with read and write access. A presenter then edited a ticket and saved it back.

A presenter said this spares builders integration work: "No need to get API keys. No need to reference API docs." Because each user's existing connectors are used, the builder need not think about permissions or access.

The second feature, WebMCP, is a new browser standard. An app exposes tools, and a WebMCP-enabled browser, here ChatGPT's in-app browser, lets the user's agent call them. A presenter said "the agent can use a site via tools instead of clicking through the UI." Rather than opening each item, as computer use does, the agent can query the backend directly, which the presenter said can be faster and cheaper.

In the gift demo, a presenter asked the agent to search Slack direct messages for what a colleague likes. The colleague was in the session. The agent found dog toys, and the presenter trimmed the list before buying.

Why it matters

Our reading: builders gain speed, and users take on the judgment. Granting a connector with read and write access takes a few words in a prompt. That is easy to do without picturing the visitor's exposure. A tool call also reaches the user's data more directly than clicking does. Direct messages hold other people's words, and those people may not have expected an agent to read them. Buyers can ask which connectors a site requests, whether it writes, and which tools it exposes.

The other side

The setup had guardrails. New sites are private by default, and private sites require sign-in first. In the gift demo, the user saw the agent's suggestions and edited them before buying. The Slack search covered messages between two presenters, and one of them was in the session. The excerpts do not say what limits apply to an agent's reach once access is granted. The demo was staged among colleagues, so it shows a design, not an observed harm.