ChatGPT Work: What It Actually Does, How It Works, and Why It's Confusing

OpenAI announced ChatGPT Work on July 9, 2026, and it's the most powerful product they've shipped — and also the hardest to understand. Simon Willison's deep dive from August 30 is the best write-up so far, but this article walks through what an engineer needs to know to actually use it.

What ChatGPT Work Actually Is

ChatGPT Work is not one product. It's two.

Work Cloud runs on chatgpt.com and the mobile app. This is the interesting version: it has a code execution environment with full internet access, a headless Chrome browser, a persistent filesystem, and the ability to deploy websites on Cloudflare Workers.

Work Local is what used to be called Codex — the desktop app that accesses files and runs programs on your local machine. OpenAI just re-skinned Codex and gave it the Work branding to make it less intimidating to non-developers.

Both require a $20/month subscription or higher. Free and $8/month Go subscribers don't get access.

Feature Deep Dive: Work Cloud

Code Execution with Internet Access

This is the killer feature. ChatGPT Chat's code interpreter is sandboxed — it can't talk to the internet, can't install arbitrary packages, and can't call external APIs. ChatGPT Work's execution environment has unrestricted internet access by default (configurable to an allowlist).

This means you can prompt it to clone a GitHub repository, install dependencies, run tests, and interact with the rest of the web — all in one session.

# Example: You can tell Work to:
# "Clone the simonw/llm repo, install it, and run the tests"
# It does the full pipeline without hitting a wall at "pip install"

Claude's equivalent container has had restricted internet access since September 2025 — PYPI and NPM only, plus GitHub clone access. ChatGPT Work's default appears to be open to all domains.

A Full Headless Chrome Browser

ChatGPT Work can launch a Chrome instance, navigate websites, fill forms, take screenshots, and — critically — run JavaScript against the DOM.

Simon Willison demonstrated this by having it load simonwillison.net and extract all headings:

// ChatGPT Work ran this against the live page
await tab.playwright.evaluate(() => {
  return Array.from(document.querySelectorAll("h1,h2,h3,h4,h5,h6"), heading => ({
    level: heading.tagName.toLowerCase(),
    text: heading.innerText.trim().replace(/\s+/g, " "),
    id: heading.id || null
  }));
});

This is the equivalent of tools like shot-scraper javascript — except you can now do it from your phone via the ChatGPT mobile app.

The browser also supports authentication flows: if a site requires login, Work prompts you to enter credentials and 2FA codes without passing them through the model itself.

Persistent Filesystem Across Sessions

ChatGPT Chat gives each session a fresh filesystem wiped between conversations. ChatGPT Work gives each session a persistent scratch folder — named something like /workspace/scratch/e00a0a017944 — that persists across sessions.

Willison reports having 171 folders in his /workspace/scratch directory. Files written in one session are accessible from others. The /workspace volume appears to be mounted across concurrently-running Work sessions, so file edits from one session are visible to others immediately.

There's a caveat: processes don't share process space. A localhost server running in one session can't be accessed from another, even though the filesystem is shared.

ChatGPT Sites: Deploy from a Prompt

ChatGPT Work can build and deploy entire websites using Cloudflare Workers. These sites support HTML, JavaScript, server-side features, Cloudflare D1 (SQLite-like database), and R2 (object storage).

Willison built a site mapping every London location with a "pelican in her piety" — a medieval Christian imagery motif — by prompting Work to research the topic, compile it to JSON, and deploy a site about it. The result was a working site at london-pelicans-in-her-piety.simonw.chatgpt.site.

Sites default to private. You can make them public or (on team plans) share them with specific individuals.

Model Selection and Reasoning Levels

Work and Chat have different model availability:

Feature	Work	Chat
Models	GPT-5.6 Sol, Luna, Terra	GPT-5.6 Instant
Reasoning	Light through Ultra	Instant through Pro ($100/mo)
Sub-agents	Yes	No
Code execution	Internet access	Sandboxed
Browser	Full Chrome	None
Persistent FS	Yes	No

The "Ultra" reasoning level appears to more eagerly delegate to sub-agents. Work sessions are billed against your Codex allowance, while Chat sessions have a separate allowance — which helps explain the model availability differences.

Sub-Agents and Scheduled Prompts

ChatGPT Work can run sub-agent sessions with Sol, Luna, and Terra as parallel workers. This is a power-user feature for complex multi-agent projects.

Scheduled prompt automations let you set recurring tasks: "run a search to see if Waymo have announced a launch date for Half Moon Bay every day at 8am." The scheduled task can notify you when something interesting happens — or, combined with ChatGPT Sites, update a deployed website on an hourly cadence.

(Scheduled prompts also work in ChatGPT Chat, but combining them with Work's exclusive features — persistent filesystem, browser, code execution — is where they get interesting.)

The Security Question

Work combines all three elements of Willison's "lethal trifecta" model for AI agent risk:

1. Access to private data — the persistent filesystem
2. Exposure to untrusted content — the headless browser and unrestricted internet
3. A way to exfiltrate stolen information — internet-connected code execution

OpenAI has described an auto-review mechanism (the same one Codex uses), but the details aren't public. If you're using Work with sensitive data, treat it like any other agent system with broad tool access: audit what it does, and keep secrets out of the prompt.

Why This Is So Confusing

OpenAI documents Work in terms of what it's for ("a task with a clear outcome") rather than what it does. The system prompts and tool definitions aren't public. Willison spent extensive experimentation just to figure out the feature matrix above.

The practical distinction: use Chat when you want an answer, use Work when you want a multi-step task with tool access. If you need internet-connected code execution, a browser, or a persistent workspace, you need Work.

What This Means for Engineers

ChatGPT Work is the first OpenAI product that genuinely integrates multiple agent capabilities into one interface. The headless browser + code execution + persistent filesystem combination is more capable than anything else in the ChatGPT product line.

The limitations right now:

• The full model selection (Luna, Terra) and Ultra reasoning are Work-exclusive but confusingly documented
• The browser's ability to handle authenticated sessions is powerful but introduces prompt-injection surface area
• Scheduled tasks combined with site deployment is genuinely useful but requires understanding several different subsystems

The key takeaway: if you've been frustrated by ChatGPT Chat's sandboxed code interpreter, or if you've wanted it to browse the web and report back programmatically, Work is the upgrade you're looking for. Just be ready for documentation that's still catching up to the product.

---

Sources: Simon Willison — Understanding ChatGPT Work (Aug 30, 2026), OpenAI — ChatGPT Work announcement (Jul 9, 2026), HN discussion (353 pts). Feature details via Willison's experimentation and OpenAI documentation.