Can you build an AI agent with ChatGPT?

Why Everyone Wants AI Agents (But Few Have Actually Shipped Them)

Every boardroom wants AI agents. Few can point to one actually running in production. The gap between those two realities is where most agent projects quietly die.

According to PwC's survey of 308 US executives, 79% of companies say AI agents are already being adopted, and 66% of adopters report measurable productivity gains — alongside 57% seeing cost savings and 55% faster decision-making. The headline numbers sound like a revolution.

But dig deeper and the picture thins out fast. Only 17% report full adoption across almost all workflows, and 68% say half or fewer of their employees touch an agent in daily work. Aggregated adoption data puts the average gap between experimentation and partial deployment at a staggering 52 percentage points — and Gartner predicts 40% of agentic AI projects will be canceled by the end of 2027.

So what's actually blocking teams? The top-cited challenges are predictable:

• Cybersecurity concerns — cited by 34% of executives as the leading blocker
• Cost — also cited by 34%, despite 88% planning to increase AI budgets
• Connecting agents across workflows — the real challenge, cited by only 19%
• Organizational change (17%) and employee adoption (14%) — the hardest work, ranked last

PwC's own analysis calls the top two what they often are: "safe excuses." When technology isn't the barrier, mindsets are. Fewer than half of companies are rethinking operating models (45%) or redesigning processes around agents (42%) — the unglamorous work that determines whether an agent actually ships.

The security concern isn't entirely an excuse, though. It's a legitimate worry that many teams handle badly rather than deeply. OWASP's new Agentic Skills Top 10 framework exists precisely because plugging third-party skills and tools into an agent carries real, documented risk — including prompt injection, excessive tool access, and data leakage.

That's why vetting what you connect to an agent matters as much as building the agent itself. SkillzBench is being built to do exactly that vetting for you — security-scanning, license-checking, and benchmarking every skill in a free, independent directory — so the security excuse stops being a reason to stall.

Which brings us to the question underneath all of this: is ChatGPT alone actually enough to build a working agent, or does the gap between experimenting and shipping live somewhere else entirely?

The ChatGPT Recipe: Model + Tools + Instructions

Yes — and OpenAI says so itself. Its official guide defines agents as systems that independently accomplish tasks on your behalf — explicitly distinguishing them from simple chatbots and single-turn LLM calls.

The recipe is refreshingly simple. An agent is just three components — Model + Tools + Instructions — and OpenAI's Agents SDK lets you assemble one in roughly four lines of Python. The model reasons, the tools act, the instructions direct. That's the whole architecture.

But before you build, OpenAI suggests asking a harder question: should you build an agent at all? Its guidance is to prioritize workflows where deterministic automation has already failed — complex decision-making, hard-to-maintain rule sets, heavy unstructured data. Otherwise, a deterministic solution may suffice. That framing matters because the top reason companies abandon agents is a lack of clear use cases, not technical failure.

Once you've picked the right problem, tool selection becomes the quality lever. OpenAI's guide offers a useful benchmark: some implementations handle more than 15 well-defined, distinct tools, while others struggle with fewer than 10 overlapping ones. Distinct, well-scoped tools beat a pile of vague ones every time. And resist the urge to go multi-agent on day one — OpenAI's general recommendation is to maximize a single agent's capabilities first, splitting into multi-agent systems only when prompts carry complex conditional logic or tool overload.

The payoff is real when it's done well. Agentic AI pilots at financial institutions saved an estimated 30,000 workdays, according to the World Economic Forum, and improved productivity on administrative tasks by 20%–59%. Thomson Reuters reported a one-third average reduction in time spent on document review, research, and drafting.

The catch is that "tools" increasingly means skill packs — and those need vetting. Research cited by Atlan found that 26.1% of community skills carry a vulnerability, which is why choosing skills carefully matters as much as choosing tools. SkillzBench is building a free directory that security-scans and benchmarks every skill it lists, so you can see measured Lift before wiring anything into your agent.

Start with one agent, a handful of sharp tools, and clear instructions. Everything else is iteration.

The Catch: Skill Packs and Tools Are a Security Minefield

Wiring tools into your agent is where the fun stops and the risk starts. The same skill packs that make your agent powerful can quietly hand attackers a door into your systems.

The numbers back this up. IBM's security guidance identifies unrestricted tool access as one of the most common vulnerabilities in agent systems, and a UC Irvine study of 238 real skills found 99% carry at least one flaw that routine review would catch. The most common issue — the "Rationalization Loophole" — appears in 94% of skills, letting an agent talk itself into skipping its own rules.

The broader ecosystem is worse than most beginners realize. Published research found roughly 26% of community skills carry at least one vulnerability, and one fake skill reportedly racked up 26,000 installs before anyone noticed. You are not just evaluating code quality — you are deciding what gets to touch your files, credentials, and customers' data.

The industry is starting to respond. OWASP's Agentic Skills Top 10 is the first comprehensive security framework for agent skills, documenting the ten most critical risks across major agent platforms. If you're building with skill packs, it's the baseline read.

IBM's doctrine for agent security is blunt: "Never trust, always verify." Their practical guidance distills to a few non-negotiables:

• Treat every tool and skill as untrusted until validated — no exceptions for popular or flashy packages.
• Never grant an agent or tool root access to your system, under any conditions.
• Wrap tool calls in permission gates with per-invocation approval and audit logging.
• Check what each skill can access and what it could leak before wiring it in.

This is why version pinning, security scanning, and license checks matter as much as a skill's raw capability. SkillzBench is being built around exactly this problem — security-scanning every skill in its directory, pinning versions to commit SHAs, and benchmarking each one in a sandbox so you can see measured Lift rather than trusting a README.

The takeaway for anyone assembling an agent with ChatGPT: the build is the easy half. Vetting what you plug in is the half that determines whether your agent ships safely — or becomes the vulnerability that reaches production.

Build It Right: A Step-by-Step, Least-Privilege Approach

The difference between an agent that works and one that becomes a security liability usually comes down to how you build it, not what you build. OpenAI's own guidance is unambiguous: customers "typically achieve greater success with an incremental approach" rather than launching a fully autonomous system on day one.

Start by picking a single workflow that resisted conventional automation — complex decision-making, hard-to-maintain rules, or heavy unstructured data. If a deterministic solution could handle it, use that instead. This matters more than it sounds: the top reason companies abandon agents is a lack of clear use cases, not missing technology.

Then assemble the core three-part recipe — Model, Tools, Instructions — using OpenAI's Agents SDK, which can stand up an agent in roughly four lines of Python. Prototype with the most capable model first to establish a performance baseline, then swap down to smaller models once behavior is stable, trading a little capability for significant cost and latency savings.

Security layers come next, added incrementally rather than all at once. IBM's security tutorial puts it bluntly: "never trust, always verify," and under no conditions should an agent or tool receive root access. A practical build sequence looks like this:

• Deploy the minimal agent — model and instructions only, no tools.
• Wrap every tool in a permission gate with per-invocation approval and audit logging, so each action is reviewable.
• Cap persistent memory (IBM's example uses roughly 20k tokens) to avoid accumulating sensitive data over time.
• Add explicit prompt-injection defenses to the system instructions before any tool goes live.

The same skepticism applies to skill packs. Community skills are convenient, but research on real-world skills found that 26.1% carry at least one vulnerability, and 99% of studied skills had at least one flaw catchable by routine review. Vetting before wiring in is not optional.

Benchmarked performance is the better filter. Curated skills raise average pass rates by 16.2 points, but 16 of 84 benchmarked tasks actually showed a negative delta — a skill can hurt as easily as help. That's why we're building SkillzBench to publish measured Lift for every skill, security-scan and license-check each one, and pin versions to commit SHAs, all free. Choose skills on evidence, not hype.

Finally, define success metrics before deployment, not after. Organizations that skip this step struggle to demonstrate value and face budget cuts. With 66% of adopters reporting productivity gains, the payoff is real — but only for agents built deliberately, one permission at a time.

Where to Find Skills You Can Actually Trust

The security problem with agent skills isn't theoretical. Research on community skill packs found that roughly 26% carry at least one vulnerability, and a 2026 UC Irvine study of 238 real skills found 99% contain at least one flaw catchable by routine review. That's why OWASP has published the Agentic Skills Top 10, the first comprehensive security framework for AI agent skills.

The stakes go beyond bugs. A IBM security tutorial puts it bluntly: "never trust, always verify" — treat every tool as untrusted until validated, and under no conditions give an agent root access to your system. A skill that looks polished can still reach for data it shouldn't, leak context, or quietly degrade performance. SkillsBench research showed curated skills lift pass rates by 16.2 points on average, but 16 of 84 tasks actually got worse with a skill installed. Skills can hurt as well as help.

So what should you actually check before wiring a skill into your ChatGPT-built agent?

• Security: what the skill can access, what it can leak, and whether it carries known vulnerabilities.
• Provenance: who wrote it, whether the version is pinned, and whether upstream changes get tracked.
• License: whether you're legally clear to use it in a commercial workflow.
• Measured impact: whether the skill has been benchmarked with and without it — not just claimed to work.

Doing all of that by hand for every skill you find on GitHub is a full-time job. That's the gap SkillzBench is being built to close. Currently in pre-launch, SkillzBench is a free, independent directory of agent skills that security-scans, license-checks, and benchmarks every listing. Each version is pinned to a commit SHA so you know exactly what you're installing, and every skill gets a published Lift figure alongside a 0–100 trust score built from security, quality, license, maintenance, and community signals.

Two design choices matter here. First, Lift is always shown separately from ratings, and money never touches scores — SkillzBench earns revenue from ads around its blog articles, never by charging users or ranking skills for pay. Second, the platform will ship with a free MCP connector, so you can toggle the skills you've chosen into any agent, and the agent only sees what you selected.

If you want to know when the directory and connector go live, you can join the SkillzBench waitlist now. Until then, the rule stands: don't trust a skill because it's popular or flashy — trust it because someone measured it.