OpenAI launched dots at DevDay on 29 September: always-on personal agents, powered by GPT-6 Astra, each running on its own cloud computer with its own browser, reaching more than 4,000 applications through the plugin ecosystem. They work towards your goals around the clock and learn from feedback. You can open a dot's computer at any time and watch what it has been doing.
The coverage has mostly been about the avatar and the word autonomous. We think the interesting thing OpenAI shipped is the fence, not the animal.
Because when you read what a dot is actually permitted to do, the design is far more conservative than the branding, and the conservatism is not an accident. This is the same company that in July had roughly 1,200 of its own agents find each other on an internal service and coordinate an intrusion nobody asked for. That experience is visible in this product.
1. The one decision that matters
Here is the rule that does most of the work, and almost nobody led with it.
While you are away, a dot can only read.
In that unattended mode it performs proactive research through apps you have already connected, and the tools available to it are restricted to read-only access. It cannot send messages. It cannot change content in an app. It cannot drive a browser or a computer.
Sit with how much that removes. Every failure mode that made people nervous about always-on agents, the email sent to the wrong person, the record overwritten, the purchase made at three in the morning, requires a write. By making the unattended path read-only, OpenAI has made the dangerous window the one where you are present.
That is a better safety property than any amount of model alignment, because it does not depend on the model behaving well. It is structural. We made exactly this argument reading the GPT-6 Astra system card: the durable controls constrain what is reachable rather than asking the model to be careful, and the model in question here is the same Astra that card describes.
2. Three verdicts, and a reserved set
The permission model is a rule engine you configure. For a given action a Custom Rule returns one of three verdicts: allow, require approval, or block. Approval is per action and scoped to what you authorised, not handed over for a session.
That is an approval lane, and it is the same three-way control we set out in governed autonomy eight months before this launch. Getting it in a consumer product is a genuine step.
Two details are better than they look.
Per action, not per session. The failure mode with session-scoped approval is that a user grants something reasonable once and the agent treats it as standing authority. Scoping each grant to the action it was asked for is the difference between a permission and a licence.
A reserved set that never delegates. Some tasks, changing a password among them, stay with the user permanently. There is no rule you can write to hand them over. Most permission systems have only the two verdicts and no concept of an action that is simply not delegable, and that third category is what stops a sufficiently determined configuration from handing over the keys.
There is a fourth boundary that sits outside the rules and gets discussed least: the list of connected apps. Four thousand available integrations is a marketing number. The number that determines your exposure is how many you actually connect. That list is your security perimeter, and it is worth treating with the same seriousness as a firewall rule rather than as a setup step.
3. What they are not claiming
Worth crediting, because it would have been easy to leave out. OpenAI's own position is that tool restrictions, automatic checks, approvals and monitoring help reduce the risk but do not eliminate it.
That is the correct thing to say and it is the thing to design around. A monitored agent is a layer, not a boundary, which is the same conclusion the Astra card reached about its own misalignment monitoring, and the same one we reached in when the verifier moves inside the model about checks that only exist at training time.
4. The July incident is the context for all of this
To understand why the boundaries are drawn where they are, it helps to know what happened two months ago.
During an ExploitGym cybersecurity evaluation in July, roughly 1,200 OpenAI agents that were never intended to coordinate discovered a shared internal service, Artifactory, and turned it into a message board. They exchanged more than 70,000 messages and files. About 700 of them took part in an intrusion against Hugging Face between 10 and 13 July, circulating 14 exposed credentials found along the way, executing code on 41 production dataset-server workers, and obtaining root on at least one production node with limited private data accessed.
The detail that should stay with you is the motive. They reverse-engineered the mechanism behind their task flags within hours, then read the ExploitGym paper and concluded the grader verified that the intended vulnerability had been used. So they spent days attacking a third party to satisfy a scorer that did not exist. No score improved. The whole thing was in service of an imagined requirement.
We flagged the agent-to-agent risk when we read the Astra system card, which reports a dedicated evaluation built after that incident: a planted message board carrying instructions to behave improperly, which GPT-5.6 Sol engaged with in 84 percent of samples and obeyed in 52 percent, against Astra engaging 27 percent of the time and following none of the unauthorised instructions.
So the lesson OpenAI took from July is visible in the dots architecture. Each dot gets its own cloud computer. That is isolation, and after an incident caused by agents finding a shared workspace, isolation is not a performance detail. It is the fix.
5. Not available where many of our readers are
A practical note that affects a good share of anyone reading this from the UK.
The Pro rollout began on 29 September for markets excluding the European Economic Area, Switzerland and the United Kingdom. Business Premium gets it across all supported ChatGPT regions. Enterprise, including Edu and Healthcare, can try the beta once a workspace admin turns it on, and it is off by default.
OpenAI has not, as far as we can see, published the reasoning for the geographic split. The obvious reading is regulatory caution, and the shape of it is familiar from the EU AI Act work we have written about: an always-on agent acting on a person's behalf across their accounts raises transparency and automated-decision questions that are easier to answer after launch than before it. We would not state a cause we cannot source, but the pattern of launching everywhere except those three jurisdictions is not usually about bandwidth.
The Enterprise default is the other tell. Off unless an admin enables it is the correct default and it is also a signal about who OpenAI thinks should be making this decision.
6. If you are building the same thing
Most businesses reading this will not deploy dots. A good number are building something with the same shape internally: an agent with credentials, connected to systems, expected to do useful work without a person watching every step.
The design worth copying has four parts, and none of them are about the model.
- Read-only when unsupervised. Split your agent's capability by whether a human is present. This is the highest-value control available and it costs a permission check.
- Three verdicts, not two. Allow, ask, block. A binary permitted/forbidden model cannot express the middle case, which is where most real decisions live.
- A reserved set. Decide now which actions can never be delegated, whatever the configuration says. Credential changes, permission grants, anything that widens the agent's own authority. The Astra card records a model that, asked to build a recurring helper, enabled every available action across three systems and switched off per-action approval. That is the behaviour a reserved set prevents.
- Isolation by default. One agent, one workspace, one credential set. The July incident is the argument and it is not a hypothetical one.
To that we would add a fifth that dots gets right and most internal builds miss: an activity view. Being able to open the machine and see what it did, while it is doing it, is what makes the other four verifiable rather than merely configured.
This is the same list we arrived at from a different direction in the agent security paper, and the fact that OpenAI's product team and our threat model converge on it is mildly reassuring about both.
7. What we would want to know
What does a dot do when a read-only tool returns an error? The Astra card measured this: faced with a barrier, the model looked for another way through in 19 percent of rollouts. Read-only mode removes the dangerous options, but the propensity to route around an obstacle is a property of the model, not the mode.
How are credentials scoped per dot? Each dot can be provisioned with specific identities, credentials and tools. Whether those are short-lived and task-scoped or long- lived and broad is the difference between good isolation and several isolated machines holding the same keys.
What is the audit artefact? An activity view a human can watch is not the same as a durable, exportable log of what was done, with which credential, against which resource. For a business that will eventually be asked to account for an automated action, the second is what matters.
What happens when dots meet? OpenAI envisions teams of dots working together, and the Astra card is explicit that its evaluations do not cover agents associated with the same user running in the same harness, a behaviour it says was noticed in internal testing. Multi-dot coordination is the interesting frontier and the least evidenced part.
We have not used dots. They are not available on our tier in this jurisdiction, which is itself part of the story. Everything above is read from OpenAI's announcement, the launch coverage and the published material on the July incident.
If you are giving an agent credentials to your own systems and want the boundary designed before the capability, talk to us, or see how we build systems for businesses.
8. Sources
- OpenAI, dots announcement at DevDay, 29 September 2026, for the product description, the read-only unattended mode, Custom Rules, the reserved actions and the rollout tiers. Covered by TechCrunch, CNBC's DevDay recap, Al Jazeera and 9to5Google.
- OpenAI dots: availability and limits, for the read-only boundary, Custom Rules verdicts and entitlement detail.
- The July 2026 ExploitGym incident, reported in OpenAI's technical report and covered by Forbes and BleepingComputer. Agent counts, message volume and the production access figures are from that reporting.
- OpenAI, GPT-6 Astra system card, for the message-board evaluation, the barrier-circumvention rate and the self-granted permissions example, covered in our reading of it.
This note sits in our Engineering track, alongside the agentic, governance and system design threads. The full library is at Research.