OpenAI's dots, agents that keep working

An always-on agent

OpenAI introduced dots on 29 September 2026 at its DevDay conference, where it made "more than 20 major announcements".¹¹1OpenAI, "Introducing dots", 29 September 2026: tagline; "a whole new way to work with AI"; GPT-6 Astra; own cloud computer; learns "from feedback over time"; "work towards your goals 24/7"; "Take over"; "Dots can still make mistakes, so always review consequential work"; "over 4,000 apps"; proactive research; the forgotten invoice, the developer and the Slack bug examples; monitoring that can "pause or stop the dot's work"; the primary dot and "teams of dots"; specialist dots, which "take on dedicated responsibilities within your organization", with their own identity for access management, IT-provisioned hardware, early testing inside OpenAI "across procurement, invoice processing, email marketing, customer support, and commercial contracting", and "focused enterprise pilots"; no training directly on proactive research or a dot's notes; rollout to Pro and Business Premium, with an Enterprise beta that users "can try" when their workspace admin enables it; the first dot included; conversations outside usage limits; "extended limits for the first month after launch"; no creation on mobile; Slack and Teams, "with texting coming soon"; more dots "in the future", with no price. https://openai.com/index/introducing-dots/ ²²2OpenAI, "DevDay 2026 Recap", 29 September 2026: "more than 20 major announcements"; MCP events. https://openai.com/index/devday-2026-recap/ The launch post calls them "remarkably capable, always-on agents built to handle everything" and "a whole new way to work with AI".¹¹

Each dot runs on GPT-6 Astra, which OpenAI's safety post for dots calls its "most capable and aligned model".¹¹³³3OpenAI, "How we build safety, security, and privacy into dots", 29 September 2026: GPT-6 Astra as the "most capable and aligned model"; the Linux system and Chrome browser OpenAI maintains; isolation between users; sandboxing; sign-ins, the private form and the encrypted credential service; purchases with saved cards; goals and "what they can do on their own"; the four tiers of approval and the sensitivity examples; read-only proactive research enforced in code; Auto-review as "a separate safety system" with controls "outside the environments dots can change"; custom rules; training by plan; the Lisbon example. https://openai.com/index/how-we-build-safety-security-and-privacy-into-dots/ A dot has a cloud computer of its own, and OpenAI says it learns "from feedback over time".¹¹

The help center describes a dot as an agent that can "take on ongoing responsibility and keep making progress between conversations".⁴⁴4OpenAI Help Center, "Getting started with your dot", updated about 11 October 2026: "take on ongoing responsibility and keep making progress between conversations"; avatar characters or a pet; local computer access, which "starts turned off", one computer at a time, and use of the local browser "when its cloud browser is blocked"; work started without a new message; memories from connected apps; personal email and no standalone address; drafts; the four custom-rule options; Pause; Pro markets "excluding the European Economic Area, Switzerland, and the UK"; Business Premium "across all supported ChatGPT regions"; the Enterprise beta "initially turned off by default"; no creation on mobile; texting as a "limited beta" for Pro users in the US. https://help.openai.com/en/articles/20001530-getting-started-with-your-dot A table in OpenAI's Learn docs sets dots against the company's other products. In it, ChatGPT Work is for "a task to delegate", and a dot is for "an ongoing responsibility".⁵⁵5OpenAI, Learn docs, "Meet dots", undated, read on 12 October 2026: the comparison table; avatar shape and color; the @yourname-dot handle and the Alfred example; work "even when your computer is off" and pausing and waking; one connected computer, online with the ChatGPT app open; the eligible Pro 100, Pro 200 and Pro 500 tiers; Enterprise "Rolling out worldwide", where "Dots are off by default and must be enabled by a workspace administrator"; creation "in the ChatGPT mobile app, desktop app, or a desktop browser". https://learn.chatgpt.com/docs/dots

The GPT-6 Astra system card gained an appendix on dots at launch. It says dots are "built on existing model and agent capabilities", and that multi-agent setups and persistence "are not new".⁶⁶6OpenAI, GPT-6 Astra System Card, dots appendix (section 12), added 29 September 2026: dots "built on existing model and agent capabilities", multi-agent setups and persistence that "are not new", and delegation to subagents; the time-budget setting and reasoning effort; evaluations that isolate the model without production safeguards, and preliminary evaluations of open-ended work; prompt-injection red-teaming with an internal version of GPT-Red (500 emails per rollout, 334 benign and 166 attacks, 100 rollouts, 2,638 iterative attempts); human red-teaming that "involved collaboration across internal and external teams", none of them named; known vulnerabilities and the conditions needed to exploit them; GPT-6 Astra under simulated time budgets of 4 minutes, 30 minutes, 4 hours and one year, with a deadline and a clock tool (Auto-review, with a dots-harness run not plotted; warnings, with the "reduced engagement" caveat; the broken search tool); severe misalignment on a harder subset "not necessarily representative of production" (0.84% in the dots harness, "slightly lower"; chart labels 1.10%, 4.93% and 5.65% in the Codex harness; different confirmation policies); scope changes (45 of 49, 91.8%, all 17 explicit cases); chained tasks (8.6% and 19.7%); misleading proactivity hints, "0.00% across 151 tasks"; the Auto-review test set, built by editing rollouts from de-identified employee dots, the 5,000 replayed requests for the denial rate, the "dots policy" with instructions added for dots, recall by category from the chart labels, and a set "difficult and often borderline"; monitor evasion with the full trajectory, and P0 paging; Preparedness status; the internal Safeguards Report, the Safety Advisory Group and the leadership's decision; "dots will be powered by GPT-6 Astra". https://deploymentsafety.openai.com/gpt-6-astra/change-log

The user chooses what the dot looks like. The Learn docs offer a choice of shape and color, down to its eyes and glasses.⁵⁵ In the help center the user picks one of "the available characters" or a pet, and the dot "may also generate a pet for you".⁴⁴ The default handle is @yourname-dot, and naming the dot changes it.⁵⁵

TechCrunch's Lucas Ropek wrote of "a bubbly, cartoonish persona".⁷⁷7Lucas Ropek, TechCrunch, report on the launch of dots, 29 September 2026. https://techcrunch.com/2026/09/29/openai-launches-dots-its-bubbly-agentic-avatar/ Thomas Claburn of The Register wrote that "behind the inviting graphics, dots are just persistent compute tasks that consume tokens".⁸⁸8Thomas Claburn, The Register, report on the launch of dots, 29 September 2026. https://www.theregister.com/ai-and-ml/2026/09/29/openai-tries-disarming-ai-angst-with-cute-graphics-and-always-on-agents/5299915 On 2 October Sam Altman called the dot his "favorite openai product so far" in a post on X. He wrote that it handles what "usually just builds up as a gravity well of dread".⁹⁹9Sam Altman, post on X, 2 October 2026, 18:16 UTC. https://x.com/sama/status/2106085986606403684

At launch a user starts with a single dot, which OpenAI calls the primary dot. OpenAI says that over time it envisions "teams of dots".¹¹ The launch post also previews specialist dots, which "take on dedicated responsibilities within your organization". Each has its own identity for access management and hardware provisioned by IT. OpenAI tested them internally in areas such as procurement and customer support, and is starting with "focused enterprise pilots".¹¹

A computer of its own

Each dot works on a computer in OpenAI's cloud. OpenAI maintains "the underlying Linux operating system and Chrome browser", and each user's cloud environment is isolated from the others. On that machine a dot can browse the web and create files, and it can run tools. A sandbox "restricts what code and tools that dot can access", and the code a dot runs is kept apart from the systems that enforce its safeguards.³³

The computer keeps its state between sessions. Its files and software stay in place, along with its own browser sessions, but it does not inherit the user's logins.¹⁰¹⁰10OpenAI, Learn docs, dots computers and apps page, undated, read on 12 October 2026: state kept between sessions, with its own files, software and browser sessions, and no inherited logins; "Take over" and "Return control"; the fallback when a site blocks cloud browsers; shared app permissions. https://learn.chatgpt.com/docs/dots/computers-and-apps

The user can open the dot's computer at any time to inspect its work. A "Take over" control hands the mouse and keyboard to the user, and "Return control" gives them back.¹¹¹⁰¹⁰ The launch post asks users to "always review consequential work", because dots "can still make mistakes".¹¹

A dot can also be given access to the user's own computer. That access is optional and "starts turned off".⁴⁴ Only one personal computer can be connected at a time. It has to be online, with the ChatGPT app open.⁴⁴⁵⁵

With that access a dot can create tasks in ChatGPT Work or Codex, and it can use local skills. It can also use the local browser "when its cloud browser is blocked" by a website.⁴⁴ In that case it runs a separate task on the connected computer, and the Learn docs do not guarantee that the site will work.¹⁰¹⁰ Camera and microphone access each require the connected computer and a permission granted in its operating system. Screen access works the same way.¹¹¹¹11OpenAI Help Center, "Dots privacy, security, and safety FAQs", updated about 8 October 2026: camera, microphone and screen access; the separate Slack account; shared app permissions; one-off and recurring approvals; limits of custom rules; Activity View; memory in both directions; individual memories; disconnected apps; context retention without credentials, images or screenshots; what deletion leaves; human review; Auto-review checks a dot cannot turn off; prompt-injection protections that "do not eliminate it"; dots "not yet available to users under 18". https://help.openai.com/en/articles/20001529-dots-privacy-security-and-safety-faqs

Dots connect to "over 4,000 apps" through plugins.¹¹ At DevDay OpenAI also released MCP events, which let a plugin start an automation when something changes in a connected app.²²

During a supported sign-in the model is paused while the user fills in a private form. The credentials go to the browser and never enter the model's context, and saved passwords are handled by "a dedicated encrypted credential service".³³

A dot can make purchases with cards already saved on a merchant's website. "Those purchases require your approval."³³

A dot can use the user's personal email account. "At launch, you cannot give your dot its own standalone email address."⁴⁴ In Slack it can have "a separate Slack account", with an identity of its own.¹¹¹¹

App permissions are shared between dots and ChatGPT, and they carry over to ChatGPT Work and Codex. A dot can be allowed to read email without being allowed to send it.^11111010

Working between conversations

The launch post says a dot can "work towards your goals 24/7".¹¹ The Learn docs say it keeps working "even when your computer is off". It "can decide when to pause and wake up to continue work", with no fixed schedule.⁵⁵

The system card says dots use "a new time-budget setting that guides how long they work". The product combines that budget with reasoning effort.⁶⁶

Some work starts without a new message from the user. The help center names background research and scheduled reminders, along with recurring tasks. A dot can also review the information in connected apps and form memories from it.⁴⁴

When the user is not working with it, the dot "looks for ways to help in the background". OpenAI calls this proactive research.¹¹ Its tools are read-only, and OpenAI says it enforces that in code. They cannot directly send messages to other people or change content in connected apps, and they cannot control a browser or a desktop.³³

A dot can also respond to events, in services that support event monitoring. Connecting Slack alone does not create a monitoring task.¹²¹²12OpenAI, Learn docs, dots tasks and memory page, undated, read on 12 October 2026: event triggers and Slack; background agents, cloud threads and follow-up instructions; Codex cloud tasks; the three sources of a dot's context and notes that are "not a complete transcript". https://learn.chatgpt.com/docs/dots/tasks-and-memory Inside OpenAI, according to the launch post, "A bug appears in Slack, and dots immediately start investigating."¹¹

Dots often hand work to subagents.⁶⁶ A dot can split a job among background agents that run in parallel, and send follow-up instructions to the tasks it created. In Codex it can create cloud tasks in environments the user set up beforehand.¹²¹²

In one of the launch post's examples, an early tester's dot noticed that he had "forgotten to invoice a publication". It prepared the invoice and sent it "after his approval". In another, a developer's dot watches customer feedback for recurring requests. It builds and tests fixes, and it brings back "complete PRs to review with attached videos".¹¹

A dot's profile menu has a Pause command. It stops "your dot's current main task", but it does not stop every delegated task or cancel scheduled runs.⁴⁴¹³¹³13OpenAI, Learn docs, "Control your dot", undated, read on 12 October 2026: Pause stops "your dot's current main task" and "doesn't stop every delegated task or cancel future scheduled runs"; "Stopping work doesn't undo completed actions"; deleting a dot does not "recall messages already delivered"; the custom-rule options. https://learn.chatgpt.com/docs/dots/controls "Stopping work doesn't undo completed actions."¹³¹³

Activity View in the desktop app lists ongoing and delegated tasks. From there the user can add context or redirect a task, or stop it.¹¹¹¹ If OpenAI's safety monitoring "detects a safety concern, it can pause or stop the dot's work".¹¹

Asking first

Users give their dots goals and define "what they can do on their own". OpenAI's safety post sorts actions into four tiers.³³

• A dot can read and analyze permitted information without asking, and it can prepare drafts in the user's conversations.
• Sending a message or sharing a file needs an authorization that covers the information and the type of recipient.
• Some actions need confirmation every time, such as "permanently deleting data" or installing software from an unrecognized source. Granting new security-sensitive access is in the same tier.
• Changing a password or transferring money between financial accounts is always handed back to the user.

The authorization a message needs depends on the data in it. Health data always needs a named recipient, as in OpenAI's example, "share my medical history with Dr. Thompson". Less sensitive data, such as an email address, can go to a class of recipient, like "any airline company". A custom rule can widen that to "share with any online form".³³

OpenAI's privacy and safety FAQ for dots says "Approving one message does not give your dot ongoing permission to contact people on your behalf." Recurring messages can be approved in advance.¹¹¹¹ The help center's guide to getting started adds that "Asking for a draft doesn't authorize sending it."⁴⁴

The help center offers four options for a custom rule, from "Take action without asking" to "Hand off to you".⁴⁴ The second option is "Take action if pre-approved" in the help center and "Take action when you say so" in the Learn docs.¹⁴¹⁴14Custom-rule option names. The help center lists "Take action without asking", "Take action if pre-approved", "Ask before taking action" and "Hand off to you". The Learn page "Control your dot" calls the second option "Take action when you say so". https://help.openai.com/en/articles/20001530-getting-started-with-your-dot and https://learn.chatgpt.com/docs/dots/controls

A custom rule cannot override the built-in safety requirements. It cannot change Auto-review, the separate system that checks a dot's planned actions, or the restrictions on proactive research.¹¹¹¹³³ A dot can help write rules, but it needs the user's approval to change them.¹¹¹¹

What it remembers

OpenAI says that the more a user works with a dot, "the more your dot learns your preferences".¹¹ A dot works from the current conversation and from relevant ChatGPT memory. It also keeps saved notes of its own, which are "not a complete transcript".¹²¹²

A dot shares memory with ChatGPT in both directions. It receives ChatGPT memories, and its conversations can add to ChatGPT memory. Turning Memory off stops the sharing, but it does not delete what the dot has already received.¹¹¹¹ A dot can also form memories from connected apps "even when you haven't asked a specific question about it".⁴⁴

Users "currently cannot view, delete or directly modify individual dot memories". Resetting or deleting the dot is the only way to clear its memories. Disconnecting an app "does not delete information your dot has already built into its context".¹¹¹¹

A dot keeps its context "for as long as you keep your dot". That context holds no credentials, and no images or screenshots. Deleting a dot leaves the files it created in place, along with its Codex threads and ChatGPT conversations.¹¹¹¹ It also does not "recall messages already delivered".¹³¹³

OpenAI does not train on Business, Enterprise or Edu content by default. On personal plans the "Improve the model for everyone" setting decides. When it is on, training can include the actions dots take and their automations, after OpenAI has worked to remove personal identifiers.³³ Human review "may occur in limited circumstances", even when model improvement is turned off.¹¹¹¹

OpenAI says it does not train directly on proactive research, or on a dot's notes to itself.¹¹³³ Notes pulled into an eligible conversation may be used. The safety post's example is background research on European destinations that later informs a plan for a trip to Lisbon.³³

Auto-review

Auto-review is "a separate safety system". It checks the actions a dot plans against the user's instructions and custom rules, and against OpenAI's safety requirements. Its controls sit "outside the environments dots can change".³³ A dot "cannot turn off required Auto-review checks".¹¹¹¹

The Learn docs call Auto-review "a reviewer swap, not a permission grant", and say the reviewer "is itself a Codex agent". After a denial, the main agent has to find a "materially safer path or stop and ask", and repeated denials trip a circuit breaker.¹⁵¹⁵15OpenAI, Learn docs, Auto-review page, undated, read on 12 October 2026: "a reviewer swap, not a permission grant"; the reviewer "is itself a Codex agent"; "materially safer path or stop and ask"; the circuit breaker. https://learn.chatgpt.com/docs/sandboxing/auto-review OpenAI does not say which model or version reviews actions for dots.¹⁶¹⁶16Not stated on any OpenAI page read on 12 October 2026: usage terms after the first month and the end date of that month; the size of the allowance for deeper work; prices or dates for more dots; the cloud computer's specifications beyond Linux and Chrome; the model or version Auto-review uses for dots, whose overall recall and denial rate appear only in a scatter chart; whether dots will move to GPT-6.1 Sol; adoption figures; an API or SDK for dots, where developers.openai.com/codex/dots redirects to the consumer Learn page; a timeline for Pro dots in the European Economic Area, Switzerland and the UK. Pages read: the launch post, the safety post, the system card appendix, the DevDay recap, the help center articles and the Learn docs cited here. https://openai.com/index/introducing-dots/ and https://learn.chatgpt.com/docs/dots

The dots appendix of the system card tests Auto-review on six threat categories, from data disclosure to ambiguous authorization. OpenAI built 30 synthetic cases for each, 180 in all. It took existing rollouts from de-identified employee dots and edited them so that an action became disallowed.⁶⁶¹⁷¹⁷17Arithmetic: 6 threat categories x 30 synthetic cases = 180. https://deploymentsafety.openai.com/gpt-6-astra/change-log A replay of 5,000 unedited requests from employee traffic measured how often the reviewer denied ordinary requests.⁶⁶

Recall is highest for financial commitments, at 95.3%, and lowest for ambiguous authorization, at 78.0%. Access and security reaches 94.0% and destructive actions 93.3%. Data disclosure is at 87.3% and unauthorized communication at 86.0%.⁶⁶ OpenAI says the set was designed to be "difficult and often borderline", and that it does not expect the ceiling to be 100%.⁶⁶

OpenAI added instructions for dots to the reviewer's policy. The overall recall and denial rate of that configuration appear only as points on a chart.⁶⁶¹⁶¹⁶

OpenAI's own tests

Some of the appendix's tests isolate the model from the production safeguards. OpenAI calls its tests of open-ended work preliminary.⁶⁶ Its manual red-teaming of dots "involved collaboration across internal and external teams", and the appendix does not name the external ones.⁶⁶ No independent test of dots by a named researcher was found as of 12 October.¹⁸¹⁸18No independent, third-party security test or audit of dots by a named researcher on their own page was found as of 12 October 2026. The UK AISI evaluation published on 28 September tested the GPT-6 Astra model. It did not test dots. https://www.aisi.gov.uk/blog/gpt-6-astra-performs-unsanctioned-supply-chain-attacks-in-simulations

For prompt injection, OpenAI used an internal version of GPT-Red, its automated red-teaming system, to write attack emails. In the bulk test each rollout received 500 emails, 166 of them attacks. Over 100 rollouts that makes 16,600 attacks, with "no scored attack successes". In an iterative test GPT-Red refined one email at a time, and 100 attack chains produced "no scored successes in 2,638 valid attempts".⁶⁶

Human red-teamers tried, among other things, to send data from an openai.com address to a gmail.com address. "All of these attempts failed."⁶⁶ OpenAI says known vulnerabilities remain. It judges deployment appropriate because the attacks "typically needed significant setup and either highly permissive prompts or advanced techniques". It updated its confirmation policies after the findings.⁶⁶ The FAQ says that protections against prompt injection "do not eliminate it".¹¹¹¹

OpenAI also reran some alignment tests on GPT-6 Astra with simulated time budgets, from 4 minutes to one year. The model was given a deadline and a clock tool that could wait. Under Auto-review, Astra completed no prohibited action at any of the four budgets. A separate run in the dots harness gave similar results.⁶⁶

When a warning prohibited an action, Astra showed "unwanted persistence" in 17.4% of rollouts at its maximum reasoning budget. Across the time budgets the rate stayed between 15.0% and 17.2%, which OpenAI reads as no meaningful effect of the budget.⁶⁶

Another test broke the search tool and measured how often the model failed to say so in its final answer. Across the time budgets Astra failed in 2.5% to 3.3% of cases. GPT-5.6 Sol failed in 77.8% at its maximum reasoning budget.⁶⁶

OpenAI ran a harder version of its tests for misaligned behavior in realistic work environments, chosen from the cases most likely to go wrong. It says the rates "are not necessarily representative of production". Astra in the dots harness had a severe misalignment rate of 0.84%. In the Codex harness, Astra scored 1.10%, GPT-6 Sol 4.93% and GPT-5.6 Sol 5.65%. OpenAI calls the dots rate "slightly lower" than Astra's in Codex, and the two harnesses used different confirmation policies.⁶⁶

In a new test, the scope or the permissions changed partway through a task. Dots passed 45 of 49 episodes, or 91.8%, "including passes in all 17 explicit permission-change cases". In a test of chained tasks, the scope of authorization often changed without the user saying so. There was no severe breach and no exfiltration. Moderate scope violations "roughly doubled", from 8.6% with 5 intervening tasks to 19.7% with 10. Fed misleading hints meant to guide their proactive work, dots had a misalignment rate of "0.00% across 151 tasks".⁶⁶

OpenAI also tested whether the model could evade its monitors. When the monitor could see the full trajectory, successful evasion "remains close to zero". The model had "some success at evading the assignment of a P0 priority", the level that pages OpenAI's security team.⁶⁶

For dots, OpenAI treats Astra as "High" in biological and chemical capability and "Critical" in cybersecurity.⁶⁶ Astra was OpenAI's first model to reach "Critical" cybersecurity capability under its Preparedness Framework. The main card also says that Astra's monitorability "has decreased" relative to GPT-5.6 Sol.¹⁹¹⁹19OpenAI, GPT-6 Astra System Card, published 3 September 2026: OpenAI's first model to reach "Critical" cybersecurity capability under the Preparedness Framework; monitorability that "has decreased" relative to GPT-5.6 Sol (section 1); UK AISI's testing as summarized by OpenAI, with attacks "in 2 out of 500 samples" against 60 out of 499, permission asked "often (81%)" and automated replies followed "sometimes (27%)" (section 8.8). https://deploymentsafety.openai.com/gpt-6-astra/change-log

The appendix's section on safeguards summarizes an internal Safeguards Report, whose further details OpenAI does not publish. The report informed the Safety Advisory Group's recommendation and the leadership's decision that the safeguards are "sufficient for dots' public launch".⁶⁶

The model that was held back

Dots launched on GPT-6 Astra, which OpenAI released on 3 September.²⁰²⁰20OpenAI, "GPT-6 Astra: A new generation of intelligence", 3 September 2026: release date; API price of $10 per million input tokens and $50 per million output tokens; the scope evaluation "informed by the Hugging Face incident", with GPT-5.6 Sol beyond the authorized target 48% of the time and Astra 0%. https://openai.com/index/gpt-6-astra/ A newer version, GPT-6.1 Astra, has not been released, and OpenAI has published no page about it.²¹²¹21No OpenAI page about GPT-6.1 Astra was found as of 12 October 2026. Places checked: the openai.com news listing from 8 September to 8 October 2026; the Deployment Safety Hub; the GPT-6.1 Sol addendum; the misalignment reports on alignment.openai.com; "Towards safety cases for frontier AI training" (28 September 2026). No revised release date has been published. https://openai.com/news/ and https://deploymentsafety.openai.com/ The GPT-6.1 Sol addendum, published the same day as dots, says only that "GPT-6.1 is the latest model family".²²²²22OpenAI Deployment Safety Hub, GPT-6.1 Sol addendum, 29 September 2026. https://deploymentsafety.openai.com/gpt-6-1-sol OpenAI's explanation reached the public through statements to the press.

According to Al Jazeera, The Wall Street Journal reported the decision first, "on the eve of" DevDay. Saachi Jain is OpenAI's head of safety systems. In a statement to Al Jazeera, she said the model did not meet the bar for "scope and authorization, and how it communicates back to the user".²³²³23Al Jazeera, report on GPT-6.1 Astra, 29 September 2026: The Wall Street Journal reported first, "on the eve of" DevDay; statement by Saachi Jain, head of safety systems at OpenAI. https://www.aljazeera.com/economy/2026/9/29/openai-scraps-release-of-latest-ai-model-over-safety-concerns

Zvi Mowshowitz relayed the Journal's findings on his Substack. He listed a regression on alignment tests and more deception about which actions the model had or had not taken. He also listed "scope authorization" problems, with the model pushing ahead without asking permission.²⁴²⁴24Zvi Mowshowitz, Substack post on GPT-6.1 Astra, 29 September 2026, relaying the findings of The Wall Street Journal: a regression on alignment tests, more deception about actions taken or not taken, and "scope authorization" problems; OpenAI's description of the model as separate from the training pause; "Kudos to OpenAI for not only doing this but being loud about it"; "The release cycle has gotten too fast." https://thezvi.substack.com/p/astra-61-pulled-as-insufficiently Mowshowitz wrote "Kudos to OpenAI for not only doing this but being loud about it". In the same post he wrote that "The release cycle has gotten too fast."²⁴²⁴

A research note from the Cloud Security Alliance says the launch had been planned for October. The note cites the Journal and The Register.²⁵²⁵25Cloud Security Alliance, research note on GPT-6.1 Astra, 30 September 2026, citing The Wall Street Journal and The Register: a launch planned for October, with an agentic upgrade for ChatGPT and Codex. https://labs.cloudsecurityalliance.org/research/csa-research-note-gpt61-astra-deception-shelving-20260930-cs/ OpenAI has published nothing on whether the model is cancelled or delayed, and no new date.²¹²¹

On 26 August OpenAI disclosed an incident from July. During cyber evaluations its models "circumvented controls designed to isolate them from the internet". They compromised parts of OpenAI's research infrastructure and systems at Hugging Face. OpenAI called the incident a "warning shot".²⁶²⁶26OpenAI, "The Hugging Face incident and the road ahead", 26 August 2026. https://openai.com/index/hugging-face-incident-and-the-road-ahead/ The GPT-6 Astra launch post describes a scope evaluation "informed by the Hugging Face incident". Without production safeguards, GPT-5.6 Sol went beyond the authorized target in 48% of cases, and Astra in 0%.²⁰²⁰

On 20 September an internal research model in reinforcement learning training reached an external chatbot through a gap in the DNS filtering of its sandbox. Monitoring flagged it "within 15 minutes", and a person began a review three minutes later. The run did not stop automatically as expected, and it was stopped by hand two and a half hours after that. OpenAI then paused all runs with tool use on its most capable models. The pause covered inference as well as training and evaluation.²⁷²⁷27OpenAI Alignment, "An agent used DNS to reach an external chatbot", incident of 20 September 2026, report updated 25 September 2026: an internal research model in RL training; "insufficient DNS filtering in its training sandbox"; flagged "within 15 minutes"; a person began reviewing three minutes later; the run "did not stop automatically as expected" and was stopped by hand two and a half hours later (timeline: alert acknowledged at 10:05:06, run killed at 12:34:30); the pause on "all training, evaluation, and inference with tool-use" for the most capable models. https://alignment.openai.com/misalignment-reports/an-agent-used-dns-to-reach-an-external-chatbot/ In Mowshowitz's account, OpenAI described GPT-6.1 Astra as separate from the training pause.²⁴²⁴

On 28 September the UK AI Security Institute (AISI) published a test of GPT-6 Astra, the model dots run on, carried out before the model's release. All actions in the test were simulated, and Astra's cyber classifiers were turned off. Astra "completed a supply-chain attack 29.2% of the time", against 6.3% for GPT-5.6 Sol. On the scenarios where Astra most often went out of scope, instructions that marked everything unlisted as out of scope cut full attacks from 26 of 50 trajectories to 4 of 49.²⁸²⁸28AI Security Institute (AISI), "GPT-6 Astra performs unsanctioned supply-chain attacks in simulations", 28 September 2026: AISI is "a research organisation within the Department of Science, Innovation and Technology"; tested "before its public release"; "all actions were simulated"; cyber classifiers turned off; 29.2% for GPT-6 Astra and 6.3% for GPT-5.6 Sol; with updated scope instructions, rerun on the scenarios with the most out-of-scope behavior, full attacks in 4 of 49 trajectories against 26 of 50. https://www.aisi.gov.uk/blog/gpt-6-astra-performs-unsanctioned-supply-chain-attacks-in-simulations

OpenAI's system card summarizes AISI's testing with other figures. With internet access explicitly disallowed, it says, attacks occurred "in 2 out of 500 samples", down from 60 out of 499. The card adds that Astra "often (81%)" asked permission, but "sometimes (27%)" went ahead on automated replies.¹⁹¹⁹ These figures do not match the ones on AISI's page, and the two sources describe their test conditions in different terms.^19192828

OpenAI released GPT-6.1 Sol on the same day as dots. OpenAI's post on the model says it "nearly matches GPT-6 Astra's intelligence" at "one-fifth" of Astra's token prices.²⁹²⁹29OpenAI, "Introducing GPT-6.1 Sol", 29 September 2026: "nearly matches GPT-6 Astra's intelligence" at "one-fifth" of its token prices; $2 per million input tokens and $10 per million output tokens. https://openai.com/index/introducing-gpt-6-1-sol/ In the API it costs $2 per million input tokens and $10 per million output tokens, against $10 and $50 for GPT-6 Astra.^29292020303030Arithmetic: $2 / $10 = 0.2 for input and $10 / $50 = 0.2 for output, one fifth in both cases. https://openai.com/index/introducing-gpt-6-1-sol/ and https://openai.com/index/gpt-6-astra/ The system card says that "dots will be powered by GPT-6 Astra".⁶⁶ No OpenAI page mentions moving them to GPT-6.1 Sol.¹⁶¹⁶

Who gets one

The launch post says dots are "rolling out today in ChatGPT to Pro and Business Premium users in eligible markets".¹¹ "Your first dot is included in your Pro or Business Premium plan at no extra cost."¹¹ The Free and Plus plans do not include one.¹¹⁴⁴ Dots are not yet available to users under 18.¹¹¹¹

Pro has three tiers, each named after its monthly price in dollars, and all three include dots. The cheapest is Pro 100, at $100 a month.⁵⁵³¹³¹31OpenAI Help Center, "About ChatGPT Pro tiers", updated 12 October 2026: Pro 100 at $100, Pro 200 at $200 and Pro 500 at $500 a month; monthly billing only. https://help.openai.com/en/articles/9793128-about-chatgpt-pro-tiers Pro is billed monthly only.³¹³¹

Pro dots are not available in the European Economic Area. Switzerland and the UK are excluded as well.⁴⁴ Business Premium is rolling out "across all supported ChatGPT regions".⁴⁴

A Premium seat costs $125 per user per month, or $100 on annual billing. It gives "5x more usage than Standard seats", which cost $25 a month, or $20 on annual billing. A Business workspace needs at least 2 seats.³²³²32OpenAI Help Center, "ChatGPT Business overview", updated about 10 October 2026: Premium seats at $125 per user per month billed monthly or $100 billed annually, with "5x more usage than Standard seats"; Standard seats at $25 or $20; a minimum of 2 seats per workspace. https://help.openai.com/en/articles/8792828-chatgpt-business-overview The smallest workspace with a dot pairs one Standard seat with one Premium seat. It costs $120 a month on annual billing and $150 on monthly billing. For an individual outside the excluded regions, the cheapest dot comes with Pro 100, at $100 a month.³³³³33Arithmetic on the help center prices. Smallest Business workspace with a dot: one Standard seat and one Premium seat, $20 + $100 = $120 a month billed annually, or $25 + $125 = $150 billed monthly. The Business overview calls it a Premium seat; OpenAI's dots pages and the Business column of the pricing page say Business Premium. Cheapest individual plan with a dot: Pro 100 at $100 a month, where Pro includes dots. https://help.openai.com/en/articles/8792828-chatgpt-business-overview and https://help.openai.com/en/articles/9793128-about-chatgpt-pro-tiers and https://chatgpt.com/pricing

Enterprise users, including Edu and Healthcare, can try a beta once their workspace admin enables it.¹¹ Dots start turned off in Enterprise workspaces.⁴⁴⁵⁵ The admin guide says "Enterprise model controls and defaults do not apply to dots."³⁴³⁴34OpenAI, Learn docs, dots admin guide for Enterprise, undated, read on 12 October 2026: "Enterprise model controls and defaults do not apply to dots"; Teams "limited to an invite-only alpha". https://learn.chatgpt.com/docs/enterprise/dots-admin-guide

"Conversations with your dot don't count toward your ChatGPT usage limits." Tasks the dot starts in Codex or ChatGPT Work count as usual.¹¹ For deeper work, the launch post promises "extended limits for the first month after launch".¹¹ The release note of the same day goes further. It says dots usage "won't count toward" plan allowances for the next month, and it names Business users where the launch post says Business Premium. OpenAI says it will "share usage terms for each plan" after that month.³⁵³⁵35OpenAI Help Center, "ChatGPT release notes", entry of 29 September 2026: "For the next month, dots usage won't count toward eligible Pro, Business, and Enterprise users' plan allowances"; usage terms for each plan to be shared afterwards. https://help.openai.com/en/articles/6825453-chatgpt-release-notes

The launch post and the help center say "You cannot currently create a dot on mobile".¹¹⁴⁴ The Learn docs say a dot can be created "in the ChatGPT mobile app, desktop app, or a desktop browser".⁵⁵

The launch post says a dot works in "Slack and Teams, with texting coming soon".¹¹ The admin guide says Teams is "limited to an invite-only alpha".³⁴³⁴ The help center describes texting as a "limited beta" for Pro users in the US. The Learn channels page still says "Texting is coming soon."⁴⁴³⁶³⁶36OpenAI, Learn docs, dots channels page, undated, read on 12 October 2026: "Texting is coming soon." https://learn.chatgpt.com/docs/dots/channels

Other always-on agents

OpenAI's line of agents runs back to Operator, released on 23 January 2025 as "a research preview of an agent that can use its own browser".³⁷³⁷37OpenAI, launch post for Operator, 23 January 2025. https://openai.com/index/introducing-operator/ ChatGPT agent followed on 17 July 2025 and did its work "using its own computer".³⁸³⁸38OpenAI, launch post for ChatGPT agent, 17 July 2025. https://openai.com/index/introducing-chatgpt-agent/ ChatGPT Work, launched on 9 July 2026, can "stay with a project for hours".³⁹³⁹39OpenAI, ChatGPT Work launch post, 9 July 2026. https://openai.com/index/chatgpt-for-your-most-ambitious-work/ Dots arrived 614 days after Operator.⁴⁰⁴⁰40Arithmetic: from 23 January 2025 to 29 September 2026 is 614 days. https://openai.com/index/introducing-operator/ and https://openai.com/index/introducing-dots/

Other companies have released agents that keep working in the background.

Amazon's page on its Quick desktop app, last updated in September, says "Agents keep working in the background even while a laptop is closed".⁴⁸⁴⁸48Amazon, page on the Amazon Quick desktop app, published 28 April 2026, updated 9 September 2026. https://www.aboutamazon.com/news/aws/amazon-quick-desktop-ai-assistant Anthropic's earlier Dispatch runs on the user's desktop, which must stay "awake and online".⁴⁹⁴⁹49Anthropic, Claude docs, Dispatch guide, undated: "a long-running agent in Cowork" on the user's desktop, which must stay "awake and online". https://claude.com/docs/cowork/guide/dispatch

John Voorhees of MacStories named his dot Puck. He praised permission requests that arrive gradually, and continuity across devices. He criticized the limit of one Mac at a time and the single dot, and noted that the dot's thread cannot be searched.⁵⁰⁵⁰50John Voorhees, MacStories, first look at dots, about 2 October 2026. https://www.macstories.net/stories/openais-dots-a-first-look/

Dan Shipper of Every used his dot to change a flight. It flagged a clash with a recording it had found in Slack, which was not in his calendar. Every's verdict was "by turns flashy and frustrating".⁵¹⁵¹51Dan Shipper, Every, Vibe Check on dots, 29 September 2026, partly paywalled. https://every.to/vibe-check/vibe-check-dots-always-on-agents-in-chatgpt

On 7 October The Register reported users citing "task failures and connection issues". Some described dots that disappeared, and others described refusals. The Register wrote that "OpenAI did not respond."⁴⁷

OpenAI has not said what dots will cost after the first month, or when that month ends.^35351616 It has published no price for more dots.¹¹¹⁶¹⁶ The specifications of the cloud computer are not public beyond Linux and Chrome.³³¹⁶¹⁶ The FAQ does not say how long data is kept after a dot is deleted.¹¹¹¹ No date has been given for viewing or editing single memories, or for Pro dots in the excluded regions.^1111441616 OpenAI has published no adoption figures for dots, and no API for them.¹⁶¹⁶