OpenAI dots: the agent that works while you sleep

A regular ChatGPT conversation lives as long as the tab is open. Close it, and everything waits for your next message. On September 29 at DevDay, OpenAI showed the opposite: an agent that keeps doing the job after you've gone to bed. OpenAI calls it a dot. Each dot gets its own cloud computer with a browser, access to your apps, and its own memory, and it's on around the clock.

I went through what dots can do at launch, how their permissions work, what they cost and where the limits are. I haven't run a dot myself yet. OpenAI's announcement page returned 403 while I was collecting material, so the facts below come from detailed write-ups that cite OpenAI's announcement and help center. The key numbers match across three or four sources; where there's only one source, I say so.

This is a snapshot as of October 17, 2026. Dots are rolling out gradually, and details will change.

What a dot is

A dot is a persistent AI agent inside ChatGPT, running on GPT-6 Astra (released September 3). Four things set it apart from a normal chat:

• Its own computer. A cloud machine with a browser that keeps running when you're not chatting. You can open it and watch what the agent is doing right now.
• Access to your apps. Mail, calendar, Slack, spreadsheets: 4,000+ services via plugins.
• Its own memory. A dot keeps notes separate from ChatGPT memory and learns from your corrections.
• Unprompted work. When you don't give it anything, it looks for ways to help. OpenAI calls this proactive research.

Every dot has a name, a look and a handle like @yourname-dot. You can talk to it in ChatGPT on desktop and mobile, in Slack and Microsoft Teams, or call it by voice. Context carries across channels.

The example everyone repeats from the launch: an early tester's dot found an invoice he had forgotten to send, assembled it from an email thread and sent it as a PDF — after he approved it. The last part is the important one.

How it works: computer, plugins and Codex

A dot is a coordinator rather than a worker. It doesn't write code itself; it hands coding to Codex and heavy office work to ChatGPT Work. Those tasks show up as their own threads you can steer directly.

• Cloud computer. Visible under Computers. You can hit Take over, drive the browser yourself and hand control back. Sign-in forms send credentials to the remote browser without the model seeing them; reusing a saved password requires your confirmation.
• Your computer. Some sites block cloud browsers, so you can let a dot use your laptop via the ChatGPT desktop app (Allow access / Revoke access). One personal computer at a time, and it must be online with the app open.
• Plugins. The same as ChatGPT, Work and Codex, with permissions per action: read email yes, send email no.
• Limits. Talking to a dot doesn't count toward ChatGPT usage limits. Codex and Work tasks it starts do.

Memory: it learns, but you can't see the notes

A dot draws on the conversation, relevant ChatGPT memory and its own notes. The notes are the most controversial part of the system: you can't view, correct or delete individual entries. The only full reset is deleting the dot. Disconnecting a plugin stops new access but keeps what was already learned; turning off ChatGPT memory stops sharing but doesn't delete what the dot already received. Credentials, images and screenshots don't go into dot context.

For an agent that reads your mail for months, the lack of a "forget this" button is a real gap.

Four rules, and what a dot will never do on its own

The core of dots isn't the model, it's the permission system. Under Custom rules, every action gets one of four modes:

1. Take action without asking — routine where mistakes cost nothing.
2. Take action when you say so — pre-approved, executed on your command.
3. Ask before taking action — the dot prepares a draft and waits for your yes.
4. Hand off to you — the dot gets the task to the point where a human is needed.

On top of your rules sit limits you can't remove:

• Password changes and money transfers always go back to you.
• Purchases need approval, and advance approval only works for a specific purchase.
• Permanent deletion and software installs may need approval every time.
• Auto-review checks actions that touch accounts or share information, such as sending email, and can block, ask or stop. The dot can't turn it off.
• Proactive research is read-only: it can't send messages, change app content or control a browser.

Pause stops the main task but not necessarily delegated or scheduled work, and nothing is rolled back: a sent email stays sent.

The safety numbers

From the GPT-6 Astra system card appendix, as reported in Flavio Copes's deep dive (the only source with the full set):

• Prompt injection: 100 runs of 500 simulated emails, 16,600 attacks — none succeeded.
• Adaptive attacker: 2,638 attempts, no success.
• Scope violations in chained tasks: 8.6% with five tasks in between, 19.7% with ten. No severe breaches.
• Permission changes mid-task: adapted in all 17 explicit cases; passed 45 of 49 episodes.
• Data exfiltration by human red-teamers: all attempts failed.

The third line is the one I care about. In a chain of ten tasks, almost one time in five the agent steps outside its brief. That's not a hack, it's an agent forgetting what it was asked — and long chains of tasks over weeks are exactly how a dot is meant to work. OpenAI says it plainly: "Dots can still make mistakes, so always review consequential work."

Who gets it and what it costs

Plan	Dots	Price
Free, Go, Plus	No, no date	—
Pro	One dot; not in the EEA, UK or Switzerland	from $100/month
Business Premium	One dot, all supported regions	$100/user/month annually, $125 monthly
Enterprise, Edu, Healthcare	Beta, off until an admin enables it	via sales

The first dot is included, with extended limits for the first month after launch. Post-launch limits, extra dots and extra capacity have no published prices yet. Setup is desktop-only, and users under 18 can't use dots.

Dots vs. the competition

Product	What it is	Difference from dots
OpenAI dots	One always-on coordinator with its own cloud computer, 4,000+ apps	Delegates to Codex and Work, strict rules, no API
Grok Bot	Closest match: persistent cloud computer, scheduled work, asks before sensitive actions	Several named Bots instead of one agent
Cursor Projects	Coordinator for long-running coding work	Coding only, returns pull requests
Meta Muse	Consumer assistant for errands, travel and forms via the Muse app and WhatsApp	Free for most uses; a small-business version launched on DevDay

This comparison is based on product descriptions, not measurements.

What dots can't do yet

• No email address of their own.
• Can't call you; texting is a narrow beta for some US Pro users.
• One primary dot per person; teams of dots are planned.
• No API.
• No way to inspect or clean memory entry by entry.

A developer's view: no API is a signal

I build apps and agents, so the first thing I looked for was a way to talk to a dot from code. There isn't one: OpenAI hasn't announced an API for dots. It's a ChatGPT product, not a developer platform.

The Codex link is telling, though. A dot can start a task in a Codex cloud environment while your computer is off, send work to your connected machine, or continue an existing Codex thread. OpenAI is building a hierarchy: on top, an agent that knows you and your work; below, specialized executors. If you build agents yourself, selling "an assistant that does everything" just got harder, while a niche executor with a clear interface is still in demand.

What I'd hand to a dot

A good dot task is recurring, spans several apps and ends in a draft:

• Every Friday at 4 pm, match delivered projects to invoices, draft missing invoices, send nothing, message me a list.
• Watch the Leads label, draft replies, ask before sending, flag anyone silent for 48 hours in Slack.
• Weekly, compare stock with reorder levels and draft purchase orders for approval. Never place orders.

A bad task is one where mistakes can't be undone: money, passwords, unchecked emails to important people. Not because the dot is dumb, but because 19.7% out-of-scope on long chains is a lot for irreversible actions. Treat it like a new assistant: drafts first, then widen permissions one at a time.

Originally published at klukyanov.ru.

Shorter weekly write-ups (in Russian) — on Telegram.