Custom GPT calls an external domain without authentication

Last updated Oct 17, 2026 Preview Policies Access & Sharing

AI summary

Rencore Governance detects custom GPTs that make unauthenticated calls to external hosts, creating unattributable and unrevocable requests. You can optionally check external domains against an approved list to determine which services your custom GPTs contact.

Severity: High External Access Recommended Preview

What it detects

Detects custom actions that call an external host with no authentication configured.

Why it matters

A custom action with no authentication sends whatever the GPT passes it to a third-party endpoint that nobody has to prove an identity to. Even where the endpoint is harmless, the call is unattributable and unrevocable. To go further and check domains against an approved list, maintain the allowed hosts as a custom property and compare them with the Action Domains field on this inventory.

The rule

Every ChatGPT Custom GPT where Has Unauthenticated Action is true

In Rencore Governance

Details

Applies to	ChatGPT custom GPT
Connector	ChatGPT Enterprise
Severity	High
Category	External Access
Recommended	Yes
Recommended automation	None
License type	Standard

Other policies that check ChatGPT custom GPT objects:

Custom GPT with an inactive owner (Medium)
Publicly reachable custom GPTs (High)
Shared custom GPTs affected by the GPT retirement (High)
Stale custom GPT (Low)
Workspace-wide custom GPTs with editable configuration (Medium)

Frequently asked questions

What does the custom GPT calls an external domain without authentication policy detect?

The Custom GPT calls an external domain without authentication policy detects custom actions that call an external host with no authentication configured.

Which objects does the custom GPT calls an external domain without authentication policy check?

The Custom GPT calls an external domain without authentication policy checks ChatGPT custom GPT objects from the ChatGPT Enterprise inventory and reports each one that matches its rule as a violation.

How severe is a violation of the custom GPT calls an external domain without authentication policy?

Violations of the Custom GPT calls an external domain without authentication policy have High severity. The policy is in the External Access category.

Which module includes the custom GPT calls an external domain without authentication policy?

The Custom GPT calls an external domain without authentication policy comes with the ChatGPT Enterprise connector (in preview) in the AI & Agents module of Rencore Governance, an add-on module on the Premium and Enterprise Plans.

Was this page helpful?