Evolution but Still Exposed: An Empirical Study of Residual APIs in the ChatGPT Plugin Ecosystem

Abstract

As large language model (LLM) platforms evolve rapidly, third-party plugin systems extend model capabilities but also introduce challenges for infrastructure governance and security. When a platform replaces an older third-party plugin ecosystem, backend services from the old ecosystem may remain reachable even after the platform no longer exposes those integrations. In this work, we focus on the early ChatGPT plugin ecosystem, which is in the original plugin store before the transition to the GPT Store. We probe domain reachability, residual configuration files, and API endpoint responses. We also use historical API records to identify backend services that standard probes miss. Our results show that 72.9% of plugin domains remain reachable, while only 6.2% of plugins retain fully functional backend APIs. Among these reachable backends, many do not declare authentication and expose numerous API endpoints that perform stateful operations. Historical probing further reveals 123 hidden backend services that remain publicly reachable but no longer appear in current configurations. These findings show that platform evolution reduces backend visibility but does not eliminate network reachability. This gap reveals a governance blind spot during the evolution of LLM platform extension mechanisms.