Inside ChatGPT Work: internet-connected code execution, a Chrome browser and deployable sites

Simon Willison has published a hands-on guide to ChatGPT Work, the product OpenAI announced on July 9, 2026 and has been revising at a fast pace ever since. Writing on his blog, in a post that reached the front page of Hacker News, he argues the product is genuinely powerful but poorly explained, and lays out what he has managed to work out so far.

Two products, not one

The first thing to understand, according to Willison, is that ChatGPT Work is really two products. The cloud edition, which he calls Work Cloud, is available through chatgpt.com and the mobile apps. Installing the ChatGPT desktop app, previously branded Codex, unlocks a second variant that can read files and run programs on the user's own machine; Willison sees this Work Local flavor as Codex re-skinned for people who are not software developers.

Access is currently limited to subscribers paying $20 per month or more. Free users and the $8 Go tier are excluded.

What Work has that Chat does not

OpenAI's official framing, Chat for answers and drafts and Work for tasks with a defined end result, strikes Willison as unhelpful, because Chat has handled exactly those jobs for years. The better question, he says, is which features exist only in Work. His list: the option to run GPT-5.6 Sol, Luna or Terra, plus GPT-5.5; a code execution environment with internet access; a headless Chrome browser; a persistent filesystem shared across sessions; the ability to publish ChatGPT Sites; sub-agent sessions; and scheduled prompt automations, which he later found also work in Chat.

On models, Work offers the same lineup as the OpenAI API, with reasoning levels running from Light up to Ultra; his experience with Codex suggests Ultra delegates to sub-agents more aggressively. Chat has a different ladder, including a Pro tier exclusive to it, and caps $20 subscribers at High. Willison suspects Work sessions draw on the Codex allowance while Chat uses a separate quota, which may explain the divergence.

Sandboxed code that can reach the internet

For Willison, the standout capability is code execution with network access. Regular Chat blocks package installs and calls to websites or APIs at the container proxy, and an install capability that briefly appeared in January no longer works, a change he notes arrived with no changelog. Anthropic's Claude container has allowed limited internet access since September 2025, but only across a short allowlist covering PyPI, npm and GitHub. Work, by contrast, appears open to the whole internet by default, with an option to restrict it to specific domains. That is enough to clone a repository, install its dependencies and then use the result to interact with the wider web.

The browser tool is close behind. Work can launch a full Chrome instance, fill in forms, take screenshots and run JavaScript against the DOM of pages it loads. Where a site demands sign-in, it can hand control to the user for passwords and two-factor codes without passing those credentials through the model itself.

Work also keeps files. Chat wipes its filesystem at the end of each session, while Work assigns persistent scratch folders, and the shared /workspace volume is mounted into every concurrently running session, so file edits in one are immediately visible in another, though processes and localhost servers stay isolated. Willison counts 171 scratch folders of his own.

ChatGPT Sites, meanwhile, lets Work build and deploy whole websites on Cloudflare Workers, including server-side code backed by Cloudflare D1 and R2. Sites default to private, but can be made public or, on team plans, shared with named individuals. Combined with scheduling, he notes, a Site could refresh itself hourly.

Why it matters

Two things make the piece worth reading beyond the product tour. First, capability: Work quietly turns ChatGPT into a general-purpose cloud agent, with broad network egress, a real browser, durable storage and deployment, and the feature gap with Chat is the real story rather than OpenAI's positioning language. Second, risk: Willison warns that Work combines all three ingredients of what he calls his lethal trifecta, meaning access to private data, exposure to untrusted content and a channel to send information back out, and he says OpenAI owes users a much fuller account of how those dangers are being handled.