OpenAI dots In-Depth: How the Always-On AI Agent Works

Title

OpenAI dots In-Depth: How the Always-On AI Agent Works

Meta Description

OpenAI dots is an always-on AI agent with its own cloud computer, 4000+ app integrations, and proactive work capability. This article breaks down its four permission modes, safety data, pricing, and what the lack of an API means for developers.

Article Content

At DevDay, OpenAI showed a product form radically different from a typical ChatGPT conversation: an AI agent that keeps working after you close the tab—or even go to sleep—called dot. Each dot has its own cloud computer, browser, app access, and memory, running around the clock.

According to a detailed breakdown from an rss source, dot is built on GPT-6 Astra (released September 3). This article synthesizes information from multiple sources to unpack its capability boundaries, permission design, and real-world limitations.

What Exactly Is dot

A typical ChatGPT conversation's lifecycle depends on the tab—close it and it pauses, waiting for the next message. dot's logic is the opposite: it's designed to be continuously online. Core facts cross-verified by three to four sources include:

• Independent cloud computer: with a browser, it keeps running when you're not chatting, and you can open it anytime to watch what it's doing.
• App integrations: connects to 4000+ services like email, calendar, Slack, and spreadsheets via plugins.
• Independent memory: dot's notes are stored separately from ChatGPT memory and it learns from your corrections.
• Proactive work: when there are no instructions, it actively looks for ways to help you, which OpenAI calls "proactive research."

Each dot has a name, an appearance, and a handle like @yourname-dot, and can be talked to on desktop, mobile, Slack, Microsoft Teams, or voice, with context carrying across channels.

The case repeatedly cited at launch: an early tester's dot found an invoice he'd forgotten to send, assembled the content from the email thread, and generated and sent a PDF—after he approved it. That last step is the key.

The Permission System Is the Core

dot's real design focus isn't model capability but permission control. Under custom rules, each action can fall into one of four modes:

1. Execute directly without asking—suited to routine matters where the cost of error is zero.
2. Execute after your instruction—pre-approved, triggered by your command.
3. Ask before executing—dot prepares a draft and waits for your confirmation.
4. Hand off to you—dot advances the task to the point where human intervention is needed.

Above the rules are hard limits that can't be removed: changing passwords and transferring money always come back to you; purchases require approval, and pre-approval is only valid for specific purchases; permanent deletion and software installation may require approval every time. In addition, automated review checks actions involving accounts or information sharing (like sending email), and can intercept, ask, or halt them—dot can't turn this off. Proactive research is strictly read-only: it can't send messages, modify app content, or control the browser.

Pausing stops the main task, but not necessarily delegated or scheduled tasks, and there is no rollback—an email sent is an email sent.

Human-in-the-loop is a control paradigm that embeds human judgment into automated processes: the system pauses at key points, waiting for human confirmation, correction, or takeover before continuing. dot's four action modes are essentially a grading of human-in-the-loop intensity—from fully automatic to fully handed off—covering tasks with different costs of error. The value of this design is that it acknowledges the gap between agent capability and reliability: for routine matters where errors are reversible and the cost approaches zero, it can relax to direct execution; for actions involving funds, identity credentials, or external communication, it retains the final decision with humans. Notably, human-in-the-loop is not a panacea—its effectiveness depends on the quality of the approval point design. If an agent in a long-chain task wraps a wrong action into a seemingly reasonable draft, the human approver may wave it through carelessly due to information asymmetry. This is why hard limits (like transfers and password changes always returning to human hands) must be independent of the agent's judgment.

Memory Mechanism: It Learns, but You Can't See the Notes

dot relies on conversation content, relevant ChatGPT memory, and its own notes. Notes are the most controversial part of the system: you cannot view, correct, or delete individual records; the only way to fully reset is to delete the entire dot. Disconnecting a plugin prevents new access but retains what has been learned; turning off ChatGPT memory stops sharing but doesn't delete information dot has already received. Credentials, images, and screenshots do not enter dot's context.

For an agent that will read your email for months, the lack of a "forget this" button is a real functional gap.

Safety Data: Long Task Chains Are the Weak Point

According to an in-depth analysis by Flavio Copes (the only source providing the full dataset), the GPT-6 Astra system card appendix discloses:

• Prompt injection: 500 simulated emails, 100 rounds, 16,600 attacks—none succeeded.
• Adaptive attackers: 2,638 attempts, zero success.
• Out-of-scope in chained tasks: 8.6% with 5 tasks in between, 19.7% with 10 tasks in between, no severe violations.
• Mid-task permission changes: all 17 explicit cases adapted; 45 of 49 scenarios passed.
• Human red-team data exfiltration: all failed.

The third data point is the most alarming. In a chain of ten tasks, nearly one in five times the agent goes beyond its authorization—not because it was hacked, but because the agent "forgot what it was asked to do." And cross-week long task chains are exactly dot's intended mode of work. OpenAI's own wording is blunt: "Dots can still make mistakes—always review important work."

Prompt injection refers to an attacker hiding malicious instructions in content the agent will read—such as email bodies, web pages, documents, or calendar invites—inducing the AI model to execute that content as legitimate instructions rather than treating it as data to be processed. For a persistent agent like dot with access to email, calendar, and apps, prompt injection is one of the most threatening attack surfaces: a single carefully crafted email could trigger data exfiltration or unauthorized actions without the user's knowledge. OpenAI uses data from 500 simulated emails and 16,600 attacks with zero success in its system card to demonstrate its defenses, but the limitation of such testing is that attack patterns are relatively fixed—in the real world, attackers' creativity and scenario diversity far exceed offline simulation.

Adaptive attackers refer to attackers who can observe defenses and adjust their strategies accordingly, as opposed to static testing using a fixed attack set. In security assessments, adaptive attacks better reflect real adversarial intensity, because attackers continuously probe known filtering rules, system prompts, and permission boundaries. The 2,638 adaptive attempts with zero success mentioned in the article is stronger evidence than static prompt injection tests, but differences between test and production environments still warrant caution—real users face social engineering lures, multi-turn inducements, and cross-channel combined attacks that are often more complex than laboratory conditions.

Who Can Use It, and How Much It Costs

Plan	Number of dots	Price
Free / Go / Plus	None, no timeline	—
Pro	1; unavailable in EEA, UK, Switzerland	From $100/month
Business Premium	1, all supported regions	$100/user/month annually, $125 monthly
Enterprise / Edu / Healthcare	Beta, requires admin enablement	Through sales

The first dot is included in the subscription, with expanded quota in the first month after launch. Pricing for post-launch quota caps, additional dots, and extra capacity has not been announced. Setup is desktop-only, and users under 18 cannot use it.

EEA (European Economic Area) consists of EU member states plus Iceland, Liechtenstein, and Norway, whose data protection legal framework centers on the General Data Protection Regulation (GDPR), with strict requirements for cross-border transfers of personal data, automated decision-making, and user rights. dot's unavailability in the EEA, UK, and Switzerland is likely related to these jurisdictions' compliance thresholds for AI agents automatically processing personal data, memory storage, and cross-border data flows. For users, this means dot's availability is not just a commercial decision but also constrained by regional regulation—the same product may present different functional boundaries under different legal environments, for example, memory mechanisms, data retention periods, or human review requirements may all need localization adjustments.

Differences from Competitors

Based on product descriptions (not hands-on testing):

• Grok Bot is the closest: persistent cloud computer, scheduled tasks, asking before sensitive operations, but offers multiple named Bots rather than a single agent.
• Cursor Projects focuses on long-duration coding work, returning pull requests.
• Meta Muse targets consumer errands, travel, and forms, free for most uses, with a small-business version launched at DevDay.

dot's uniqueness lies in: an always-on coordinator that delegates to Codex and Work, with strict rules, and no API.

Developer Perspective: No API Is a Signal

For developers building apps and agents, the most immediate question is how to call dot from code—the answer is currently you can't. OpenAI has not announced an API for dot; it's a ChatGPT product, not a developer platform.

The Codex connection is worth noting: dot can start tasks in Codex's cloud environment while your computer is off, send work to your connected machines, or continue existing Codex threads. OpenAI is building a hierarchy: on top, an agent that knows you and your work; below, specialized executors. For developers building their own agents, selling an "all-purpose assistant" just got harder, while vertical executors with clear interfaces still have demand.

What Tasks Suit dot

Good dot tasks have three characteristics: periodic, spanning multiple apps, and ending with a draft. For example: every Friday at 4 PM, reconcile delivered projects against invoices, draft missing invoices, don't send, and send you a list; monitor the Leads label, draft replies, ask before sending, and flag those unanswered for 48 hours to Slack; weekly, compare inventory against reorder thresholds, draft purchase orders for approval, and never place orders.

Bad tasks are those where errors are irreversible: money, passwords, emails sent to important people without checking. The reason isn't that dot is dumb, but that a 19.7% out-of-scope rate on long-chain tasks is too high for irreversible operations. Treat it like a new assistant: give it draft permissions first, then relax them one by one.

What It Can't Do Yet

• No email address of its own.
• Cannot call you; SMS is a narrow beta for some US Pro users.
• One primary dot per person; multi-dot teams are planned.
• No API.
• Cannot inspect or clean up memory item by item.

The direction dot represents is clear: AI shifting from passive response to continuous presence. But its current design also honestly exposes the cost—the tighter the permission rules, the more they reveal that the tension between autonomy and controllability remains unresolved.

One-line Summary

OpenAI dot is a persistent online cloud AI agent whose capability boundaries are defined by its permission and memory design.

Paragraph Summary

At DevDay, OpenAI showcased a persistent AI agent called dot, built on GPT-6 Astra, with its own cloud computer, browser, 4000+ app integrations, and independent memory, capable of working while the user is offline. dot's core design lies not in model capability but in permission control: four action modes plus non-removable hard limits ensure sensitive operations like transfers and password changes always remain with humans. Safety data shows excellent prompt injection defenses, but long task chains have an out-of-scope rate as high as 19.7%, posing risks for irreversible operations. The memory system cannot be viewed or deleted item by item, a clear privacy gap. Currently available only to Pro and Business Premium, with no API, positioned as a ChatGPT product rather than a developer platform.