On 29 September 2026, at DevDay, OpenAI launched dots. A dot is a ChatGPT agent with its own cloud computer, and it keeps working after you close the chat. I spent today reading everything OpenAI published about them, and then I asked the question I always ask as an engineer: how would I build something like this myself?
One thing first. I could not use a dot. They are a hosted feature on paid plans with no local version, so there was nothing for me to run or measure. Every statement about dots below comes from OpenAI's launch post, its safety post and two help pages, read on 4 October 2026. The design part is general design, not OpenAI's internals, which it has not published.
What a dot is
An agent is an AI model that does more than answer. It takes actions one after another, such as opening a web page, editing a file or drafting a message, to reach a goal you gave it.
In a normal chat, the model answers and then waits for your next message. A dot does not wait. OpenAI calls dots "always-on agents", says they run on GPT-6 Astra, and says they can connect to over 4,000 apps through plugins. You can talk to yours in ChatGPT on desktop, web and mobile, and in Slack and Microsoft Teams.
A dot can start work without a new message from you in two ways:
- It runs reminders and recurring tasks you scheduled.
- It does what OpenAI calls "proactive research": it reads the apps you connected, looks for ways to help and saves private notes.
The second one is the interesting part. OpenAI says those research tasks use read-only tools, enforced in code, that "cannot directly send messages to other people, change content in connected apps, or control a browser or desktop". Anything the dot then wants to do goes through the normal approval rules.
Who can use one
At launch, OpenAI's help page lists Pro users outside the European Economic Area, Switzerland and the UK, Business Premium in all supported regions, and Enterprise, Edu and Healthcare as a beta that stays off until an admin turns it on. Your first dot is included on Pro and Business Premium.
What OpenAI says keeps it in check
An agent that can act on your accounts can also act wrongly on them. OpenAI's own safety post says a misunderstood request "could lead it to change the wrong file or share information you intended to keep private". Here is what it says it built around that:
- A separate computer. Each dot works on its own cloud computer. Access to your laptop starts turned off.
- Passwords kept away from the model. For supported sign-ins the model is paused while you type into a secure form, and the password goes straight to the dot's browser.
- Your rules per kind of action. Take action without asking, take action if pre-approved, ask first, or hand off to you.
- You do the most sensitive steps. Changing a password or moving money always needs you to take over.
- A check before actions run. A separate checker, which OpenAI calls auto-review, looks at some planned actions first, for example who an email is going to and what it says.
Two things deserve a careful read. First, memory: according to OpenAI's privacy FAQ, you cannot currently view or delete one dot memory at a time, and disconnecting an app does not delete what the dot already learned from it. Deleting the whole dot is the way to delete its context.
Second, prompt injection. That means hidden instructions inside a web page, email or document that try to trick the agent into doing something you never asked for. OpenAI does not claim to have solved it. In its own words: "These protections help reduce the risk of malicious instructions causing an unwanted action, but they do not eliminate it."
How I would build an always-on agent
Here is the general design I would use for any agent that keeps working after the user leaves. Again, this is not OpenAI's system.
1. Make the task durable. A web request lives for seconds. An agent task can run for days. So I store the task as a workflow: a list of steps, with each step's result saved before the next one starts. This is called durable execution, and engines such as Temporal are built for it. Closing the chat stops nothing, because the task never lived in the chat.
2. Save a checkpoint after every step. A checkpoint is the saved result of a finished step. After a crash, a new machine reads the last checkpoint and carries on, so a crash costs one step, not the whole job. Steps that change the outside world, like sending an email, must be idempotent: running them twice has the same effect as running them once. An idempotency key, a unique ID sent with the action, lets the other side ignore a repeat.
3. Give it its own sandbox. A sandbox is a virtual machine or container walled off from other users and from your own systems. I run the parts that enforce the rules somewhere else, so a confused or tricked agent cannot switch them off.
4. Connect apps with narrow, short-lived tokens. A token is a temporary key limited to scopes such as "read my calendar". I keep tokens outside the sandbox in a small service that hands out only what one step needs. Background jobs get read-only scopes, the same idea OpenAI describes for proactive research.
5. Put a gate in front of every risky action. When an action needs a yes, the workflow saves its state and sleeps until the person answers. A sleeping workflow costs almost nothing, so waiting a whole day for an approval is affordable.
6. Put a budget on everything. Always-on does not mean the model is always running. Most of the time the agent is waiting for a trigger: a message, a schedule or an app event. I cap each task's steps, tokens and time, and stop a task that keeps getting its actions refused.
What I took away
The model is the least surprising part of dots. The real change is where the work lives. In a chat, the work lives in your browser tab, so it ends when you leave. In an always-on agent, the work lives in a workflow engine, one checkpoint at a time, and the chat is just one of several ways to talk to it.
That also tells you where the risk is. Everything the model reads is untrusted, so anything that must not be fooled, such as passwords, rules and tokens, has to live outside the box the model runs in. OpenAI's design points the same way, and it is honest that this reduces the risk rather than removing it.
I wrote a longer version with the full lifecycle diagram, the plan table, a FAQ and links to every OpenAI page I used: OpenAI dots, explained.
Top comments (0)