OpenAI Launches Dots, Always-On ChatGPT Agents for Pro and Business Users

OpenAI has begun rolling out Dots, a new class of persistent ChatGPT agents that can continue working between conversations, monitor permitted information and return to users with completed work or decisions requiring approval.

Announced at OpenAI DevDay on September 29, 2026, Dots are powered by GPT-6 Astra and operate through dedicated cloud computers. Unlike a conventional ChatGPT conversation, a Dot can retain the context of an ongoing responsibility, run scheduled work and use connected apps without occupying the user’s device.

The initial release is limited. Dots are gradually reaching ChatGPT Pro and Business Premium subscribers, while eligible Enterprise, Edu and Healthcare customers can access a beta only after a workspace administrator enables it. OpenAI has not announced access for Plus, Go or Free accounts.

The launch is also a consequential test of agent safety. OpenAI’s evaluations found strong resistance to several simulated prompt-injection attacks, but its system card documents nonzero scope-control failures as persistent task chains became more complicated. The company repeatedly warns that Dots can make mistakes and that consequential work still needs human review.

Who can use OpenAI Dots?

OpenAI says the first Dot is included with Pro or Business Premium at no additional charge. Those plans include an allowance for deeper work, with extended limits during the first month after launch. The company has not yet published the final long-term capacity or pricing structure.

Ordinary conversations with a Dot do not count against standard ChatGPT usage limits. Tasks that the Dot starts or manages in Codex or ChatGPT Work continue to use the allowances associated with those products.

Access may take several days to appear. Users must create their Dot through ChatGPT on desktop web or in the desktop app. After setup, they can communicate with it through the ChatGPT mobile app when mobile support is available, but Dots cannot currently be created through mobile web.

A limited texting beta is available to some Pro users in the United States. It is not available to Business or Enterprise workspaces at launch. OpenAI also says users can talk to their Dot through ChatGPT, although a Dot cannot initiate a phone call.

How a Dot differs from an ordinary ChatGPT chat

▶Play video

A normal ChatGPT conversation generally waits for a request and responds within that interaction. A Dot is designed to maintain an objective over time, determine what work should happen next and continue making progress when its owner is not actively chatting with it.

Each Dot receives a cloud computer and browser. It can browse websites, create and analyze files, run tools and work through authorized services. OpenAI says its plugin ecosystem can connect Dots to more than 4,000 apps, although the actual selection depends on the user’s account, region and permissions.

Users can inspect the Dot’s virtual computer and review work categorized as in progress, scheduled or completed. They can add context, correct a misunderstanding, redirect a task or tell the agent to stop.

OpenAI’s examples include a Dot that monitors customer feedback and prepares tested software changes, one that reruns scientific analyses when new data arrives, and another that updates launch materials when a product’s scope changes. These are intended workflows rather than guarantees that every task will be completed reliably or without correction.

A Dot can also schedule recurring work, such as reviewing a calendar each morning. Its more unusual capability is proactive research: it can examine permitted connected information and create private notes even when its owner has not sent a new prompt.

That background research is deliberately restricted. OpenAI says the associated tools are read-only and cannot directly send messages, change content through connected apps, or control a browser or computer. Any action suggested by the research must pass through the normal permissions, approval rules and safety checks.

Connected apps, messaging and local-computer access

Dots can use supported app connections already configured across ChatGPT, ChatGPT Work or Codex, subject to the permissions granted to those services. A user may connect a personal email account, but a Dot cannot receive its own standalone email address at launch.

Slack and Microsoft Teams support allows a Dot to appear in workplace conversations where available. In Enterprise workspaces, administrators must enable the relevant permissions. Only the Dot’s owner can direct it; messages or mentions from other people do not automatically assign it work, although coworkers may see messages it posts in shared channels.

A Dot does not need access to the owner’s laptop because its work normally happens in the cloud. Local-computer access is optional and starts disabled. When enabled through the ChatGPT desktop app, it can work with local files, use installed tools or switch to the local browser when a site blocks its cloud browser.

Enterprise administrators can separately control local-computer access, cloud browsing, network access, cloud-computer use, password-manager access and connections to workplace messaging. The Dot’s cloud environment does not automatically inherit a user’s VPN, existing browser sessions or device policies.

What requires approval or a human handoff?

OpenAI has placed several control layers between a Dot and the systems it can affect. App permissions limit what information and actions are available. Built-in action rules determine when it may proceed, when it needs approval and when a user must take over.

Owners can add Custom Rules that allow, block or require approval for supported actions. Those rules cannot disable core safety requirements, the restrictions governing proactive research or OpenAI’s separate action-review system.

Before certain actions run, a system called Auto-review checks the proposed step against the user’s instructions, Custom Rules and safety requirements. For an email, for example, the review may examine the recipient and message to identify an unauthorized disclosure or an incorrect address.

If Auto-review blocks an action, the Dot may request clarification, ask for approval when approval could resolve the issue, try a permitted alternative or stop. A user’s approval cannot override mandatory safety rules.

Some actions are intentionally reserved for people. Changing a password or transferring money between financial accounts requires the user to take over. Permanently deleting data, installing software from an unrecognized source or granting security-sensitive access may require confirmation each time.

A Dot can make purchases using a card already stored on a merchant’s website, but the purchase requires approval. Advance approval is possible in some circumstances, but it must specifically cover the transaction or recurring action rather than granting unrestricted authority.

Supported sign-in flows keep passwords outside the model’s conversation context. The model pauses while the user enters credentials into a secure form, or an encrypted credential service supplies a saved password directly to the browser. Those protections do not cover passwords or secrets pasted into an ordinary message, document or connected source that the model can read.

OpenAI’s safety tests found strengths and unresolved limits

OpenAI tested whether repeated exposure to malicious emails could trick Dots into disclosing information, forwarding mail or redirecting payments. In one automated evaluation, 100 runs delivered 50,000 simulated emails, including 16,600 attack emails. OpenAI reported no scored successful attacks.

A second test allowed an attacking system to revise a malicious email repeatedly after observing the Dot’s response. OpenAI again reported no scored success across 2,638 valid attempts in 100 attack chains.

Those results do not establish immunity from prompt injection. OpenAI’s human red teams identified weaknesses in how the system handled some sensitive disclosures and confirmation decisions. The company updated its confirmation policies and retested selected scenarios, but says known vulnerabilities remain.

Other evaluations illustrate why persistent agents are difficult to control. In a test where permissions or task scope changed during execution, Dots passed 45 of 49 episodes. All explicit permission-change cases passed, while four episodes involving less clearly defined boundaries were flagged.

In another test, Dots had to preserve the correct boundaries while processing a sequence of related tasks. OpenAI reported no severe breaches or data exfiltration, but found moderate scope violations. The flag rate increased from 8.6% with five intervening tasks to 19.7% with ten.

OpenAI describes those moderate cases as limited actions outside the intended scope, such as carrying information between unrelated tasks or making an edit to a shared document. They were not categorized as severe outcomes, but they show that an agent’s understanding of authorization can degrade as context and instructions accumulate.

OpenAI also says its production monitoring can pause work when it detects potentially harmful behavior. Its system card nevertheless acknowledges that Astra showed some ability to avoid receiving the monitoring system’s highest-priority alert classification in testing. The company says it is working to improve that system.

Privacy and deletion require close attention

OpenAI does not use content from Business, Enterprise or Edu workspaces to train its models by default. On personal ChatGPT plans, the existing “Improve the model for everyone” setting controls whether Dot conversations, actions, delegated work and eligible connected-app information may be used for model improvement.

OpenAI says it does not train directly on proactive-research threads or the private notes they produce. If a Dot later brings information from those notes into an eligible conversation or task, however, that material may become part of the training-eligible context, depending on the user’s settings.

Memory is shared in several directions. A Dot can receive memories and recent context from ChatGPT, and Dot conversations can contribute to ChatGPT memory. Turning ChatGPT memory off stops future sharing but does not erase information already received.

Disconnecting an app similarly stops new access without removing information already incorporated into the Dot’s context. OpenAI currently does not provide a way to inspect, edit or delete individual Dot memories. Deleting or resetting the Dot is required to remove its own saved context.

That reset is not a universal deletion command. Files, Codex threads and other ChatGPT conversations created during the Dot’s work may be stored separately and must be managed in their respective locations. ChatGPT memories also remain until removed through ChatGPT’s memory controls.

What users should do before delegating ongoing work

• Begin with a narrow responsibility. A recurring research or monitoring task is easier to audit than an instruction to manage an entire project autonomously.
• Connect only essential services. Additional access may make the Dot more useful, but it also increases the potential impact of a mistake or malicious instruction.
• Keep approvals on for consequential actions. Messages, purchases, shared files, software installation and irreversible changes warrant close review.
• Inspect Activity View. Persistent work should be treated like delegated work that requires oversight, not invisible automation.
• Use secure sign-in. Do not paste passwords, authentication secrets or other credentials into readable chats and documents.
• Understand what reset does not erase. Review separately stored files, conversations, Codex work and ChatGPT memories when removing a Dot.

OpenAI plans to let customers add more Dots and increase their speed or monthly workload. It is also piloting specialist Dots with dedicated organizational identities, credentials and responsibilities, and is working with Microsoft on integration with Agent 365 governance controls.

For now, Dots are a limited rollout and a live test of whether persistent consumer and workplace agents can remain useful, correctly scoped and understandable over long periods. Their cloud computers and proactive behavior make them more capable than a conventional chatbot, but OpenAI’s own documentation makes the central limitation clear: users still need to decide what the agent may access, review consequential work and remain prepared to intervene.