OpenAI's dots are always-on ChatGPT agents with their own cloud computers

An agent that stays on

At its DevDay event on September 29, OpenAI demonstrated "dots," persistent AI agents inside ChatGPT that keep working after the user closes the conversation. According to a dev.to write-up published October 17, each dot runs on GPT-6 Astra, released September 3, and gets its own cloud computer with a browser that stays on around the clock. Users can open that machine at any time to watch what the agent is currently doing, or take control of the browser themselves.

A dot also connects to more than 4,000 services through plugins, including mail, calendar, Slack and spreadsheets, and keeps its own notes, separate from ChatGPT memory, that grow as it learns from the user's corrections. Left without a task, it performs what OpenAI calls "proactive research": read-only looking for ways to help. Each dot has a name, an appearance and a handle like @yourname-dot, reachable from ChatGPT on desktop and mobile, from Slack and Microsoft Teams, or by voice, with context carried across channels. The example repeated through the launch coverage: a tester's dot found a forgotten invoice, assembled it from an email thread and sent it as a PDF, after the tester approved it.

The dev.to author notes OpenAI's own announcement page was unreachable during research, so the figures come from secondary write-ups; the key numbers matched across several of them, and single-source items are flagged as such.

A coordinator with executors

A dot does not do the work itself. Per the write-up, it delegates coding to Codex and heavy office work to ChatGPT Work, each surfacing as its own steerable thread. Tasks it launches in Codex count against usage limits; talking to the dot does not. Sites that block cloud browsers can be handled another way: the dot can be granted access to the user's own laptop through the ChatGPT desktop app, one machine at a time, provided the app is open and the computer online. Plugin permissions are set per action, for example allowing email to be read but not sent, and sign-in forms pass credentials to the remote browser without the model seeing them.

Four permission modes and fixed limits

The permission system is the core of the product. Under custom rules, every action falls into one of four modes: act without asking, act when told, prepare a draft and wait for approval, or hand the task back to a human. On top of those sit limits users cannot remove. Password changes and money transfers always return to the human, purchases require approval tied to a specific transaction, and an automatic review layer that watches actions touching accounts or sharing information cannot be switched off. Pausing a dot stops the main task but not necessarily delegated or scheduled work, and nothing is rolled back: a sent email stays sent.

Memory without an edit button

The write-up flags one gap. A dot's notes cannot be viewed, corrected or deleted individually; the only full reset is deleting the dot. Revoking a plugin stops future access but keeps what was already learned, and turning off ChatGPT memory sharing does not erase what the dot already received.

Scope violations in long task chains

The safety figures in the write-up come from the GPT-6 Astra system card appendix via Flavio Copes's deep dive, which the author identifies as the only source carrying the full set. Prompt-injection testing across simulated emails, 2,638 adaptive attacker attempts, and human red-team exfiltration attempts all failed. But scope violations in chained tasks reached 8.6 percent with five intervening tasks and 19.7 percent with ten. That is an agent drifting from its brief rather than being attacked, which matters for a product designed to run long task chains over weeks.

Availability and pricing

Dots are rolling out gradually. According to the write-up, Pro users get one dot from $100 per month, though not in the EEA, UK or Switzerland; Business Premium gets one dot at $100 per user monthly on an annual plan or $125 monthly; and Enterprise, Edu and Healthcare deployments are in beta, disabled until an administrator enables them. Free, Go and Plus tiers have no access and no announced date. Setup is desktop-only, users under 18 are excluded, and there is no API. To the author, that absence is a signal: OpenAI is building a hierarchy of a coordinator that knows the user above specialized executors like Codex, which makes selling a general-purpose "does everything" assistant harder while leaving room for niche executors with clear interfaces.

Why it matters

Most agents today stop when the tab closes. Dots invert that: a named agent with its own computer, broad app access and persistent memory, running continuously in the background. If the approach holds, the hard problems shift from raw capability to governance, including an opaque memory users cannot audit and scope drift in exactly the long, multi-app chains this product exists to run.