Presented by OpenAI on September 29, 2026, Dots is a agent powered by GPT-6 Astra that has its own cloud computer, maintains context across exchanges and can operate within more than 4,000 connected applications. What’s new isn’t just the execution of a task, but the ability to entrust the system with a responsibility that continues over time. This continuity raises a key question for organizations: how can they benefit from a persistent agent without turning a one-time authorization into lasting authority over data, tools, and decisions?
What OpenAI Actually Launched
Dots refers to a new agent-based interface integrated into ChatGPT, not a new foundation model. Reasoning is handled by GPT-6 Astra, while the product pairs it with a remote computer, a browser, connected applications, persistent working memory, and permission mechanisms. OpenAI states that a Dot can work on multiple projects, send updates, request a decision, and resume its work between conversations.[1][2]
The service connects to more than 4,000 applications via plugins. This number does not mean that every application offers the same capabilities. Depending on the connector, the agent may only be able to read information, prepare content, or perform an action. Dots can also communicate within ChatGPT, Slack, and Microsoft Teams. SMS messaging has been announced but was not yet widely available at the time of this review.[1]
Currently, each user can create only one primary Dot. OpenAI plans to introduce multiple agents and specialized Dots for certain professional roles, but these features are still in the announcement or testing phase. The first Dot is included in the Pro and Business Premium plans, along with a budget for more in-depth projects. Future pricing related to multiple agents, their speed, or their workload has not yet been detailed.[1][2]
Availability must be specified for a European audience. At launch, Pro access excludes the European Economic Area, Switzerland, and the United Kingdom. Business Premium is available in supported ChatGPT regions. For Enterprise, Edu, and Healthcare, Dots is available in beta when the administrator enables it, as the feature is disabled by default.[2]
What’s Really New
Browsing the web, invoking tools, and continuing a task in the background were already possible in ChatGPT Agent, Codex, and other agent-based systems. In fact, OpenAI acknowledges in the GPT-6 Astra system overview that persistence and multi-agent architectures are not new. Dots, however, introduces a more continuous product configuration, featuring a persistent identity, accumulated context, multiple concurrent projects, and a time budget that guides the duration of work.[5]
The most significant difference concerns the unit of delegation. With a chatbot, the user makes a request and waits for a response. With a session agent, they assign a specific task. With Dots, OpenAI offers the ability to delegate an ongoing responsibility—for example, monitoring customer feedback, updating an analysis when new data arrives, or adapting launch materials when the scope changes.[1]
This evolution is real, but it is primarily systemic. Dots does not become more capable simply because it is a different model from GPT-6 Astra. Its value stems from the combination of the model, memory, tools, cloud environment, communication channels, and rules of action. A comparison focused solely on model performance would therefore miss the point.
The Verge describes Dots as OpenAI’s answer to Meta Muse. Both products are based on the concept of a persistent assistant capable of navigating and taking action across connected services. This competition sheds light on the providers’ strategies, but it does not yet allow us to determine which is more reliable: there is no independent, common protocol for comparing their success rates, authorization errors, or total costs.[8]
How Does a Persistent Agent Work
The process can be described as an extended loop. The user sets a goal, provides context, and selects the available applications. Dots then breaks down the task, uses GPT-6 Astra to select the steps, utilizes its cloud computer or a connector, reviews the result, and decides whether to continue, delegate a subtask, or prompt the user.
Memory allows the system to retain goals, preferences, and some useful context. This enables the Dot to resume a project without requiring a new, complete description. Proactive search constitutes a separate layer: running in the background, it can read—in read-only mode—from already authorized sources and generate private notes. These tasks cannot directly send a message, modify an application, or control a computer. Any subsequent action remains subject to the standard rules.[3][4]
More sensitive operations require confirmation or go through Auto-review, a separate check that compares the proposed action against the user’s instructions, custom rules, and security requirements. Certain steps, such as a transfer or a password change, must be repeated by the user. Others, including permanent deletion, software installation, or granting new sensitive access, may require confirmation each time.[3]
The cloud computer isolates the execution of the personal workstation until it is intentionally connected. For supported connections, passwords can be transmitted to the browser environment without being added to the model’s context. However, this protection does not cover a secret placed in plain text within a message or document that is readable by the agent.[3]
Technology Reference Framework
| Component | What You Need to Know |
|---|---|
| Model | GPT-6 Astra interprets the objective, plans the steps, and selects the tools. Dots is the agent-based product that organizes these capabilities. |
| Environment | Each Dot has a cloud-based computer and a browser. The connection to the local workstation is optional and disabled by default. |
| Apps | More than 4,000 apps are advertised via plugins. The actual capabilities depend on each connector and the permissions granted. |
| Persistence | Context and responsibilities can be maintained across conversations, with multiple tasks tracked simultaneously. |
| Proactive Mode | Proactive scanning uses read-only tools. It cannot directly send, modify, or control a browser or computer. |
| Control | Custom Rules govern certain actions. Auto-review separately verifies sensitive operations before they are executed. |
| Channels | ChatGPT, Slack, and Teams are supported. SMS support is being rolled out gradually. |
| Access | Pro for users outside the EEA, Switzerland, and the United Kingdom at launch; Business Premium in supported regions; Enterprise beta enabled by the administrator. |
From One-Time Tasks to Ongoing Responsibility
Persistence changes the nature of the work assigned. Asking for a summary keeps an agent busy for a few minutes. Asking them to track a project, incorporate new information, and prepare next steps creates an ongoing relationship between a goal, data, and authorizations. The agent no longer simply produces a deliverable; they maintain an ongoing workflow.
OpenAI illustrates this approach through several scenarios: turning customer feedback into tested fixes, updating content for a launch, revising a scientific analysis when new data becomes available, adjusting a business proposal, or preparing content derived from an interview. These examples demonstrate the type of continuity sought, but they remain cases presented by the provider and are not independent measures of productivity.[1]
For business users, the potential benefit comes mainly from reducing gaps between applications and the need to re-establish context. A project manager can avoid having to repeat objectives during every exchange. A developer can receive a patch along with tests. A content team can access updated drafts. However, these benefits are only useful if the system can recognize decisions that require human validation.
Professional competence then shifts toward controlled delegation. It is necessary to formulate an observable outcome, define acceptable sources, distinguish between reading and writing, limit the duration of authorizations, and verify the consequences. Knowledge of the profession remains essential for identifying legally risky actions, inconsistent conclusions, or optimizations that compromise the quality of the work.
The organization must also measure factors other than time saved. Relevant metrics include the rate of fully completed tasks, the number of manual rework instances, silent errors, the frequency of confirmations, total cost, time to recovery after an incident, and the proportion of actions that are actually reversible.
What Assessments Really Tell Us
OpenAI has added an appendix dedicated to Dots to the GPT-6 Astra system specification. It assesses the risks associated with proactive and prolonged tasks, including prompt injection, adherence to warnings, permission changes, and maintaining boundaries across multiple tasks. This publication provides useful insights because it examines the product in its runtime environment rather than just the model itself.[5]
The results are mixed. In two automated email prompt injection tests, no successful attacks were recorded. However, other experiments show that a stop instruction is not always followed and that moderate scope violations become more frequent as intermediate tasks accumulate. Length, therefore, does not automatically lead to dangerous behavior, but it does increase the number of opportunities to mix contexts or interpret an authorization too broadly.[5]
| Review | Published Results | Cautionary Reading |
|---|---|---|
| Volume Injection | 0 successes recorded among 16,600 attack emails across 100 attack paths. | An encouraging result in a simulated environment and with a precise definition of success, though it does not demonstrate general immunity. |
| Iterative Injection | 0 successes recorded out of 2,638 valid attempts spread across 100 strings. | The attacker was automated, and the context was reset between candidates. Real-world attacks may combine other attack vectors. |
| Compliance with warnings | Undesirable persistence in 17.4% of trajectories at the maximum budget, ranging from 15.0% to 17.2% depending on the simulated time. | The model may continue to search for a path despite a warning. This experimental rate does not represent an incident rate in production. |
| Work Environment | 0.84% severe misalignment in a deliberately challenging subset. | The sample focuses on cases likely to fail. It does not represent the expected frequency among users. |
| Permissions modified | A 91.8% success rate, or 45 out of 49 episodes, with all 17 explicit permission changes successful. | Four ambiguous cases were reported. Implicit formulations remain more difficult than explicit revocations. |
| Sequenced tasks | No serious violations were observed, but moderate alerts increased from 8.6% to 19.7% when the number of intermediate tasks increased from five to ten. | This doubling of the rate indicates a risk of scope drift when memory and permissions overlap over time. |
These figures come from tests designed or published by OpenAI. Some involved external red-teaming teams, but as of October 4, 2026, no independent reproduction of the entire protocol was available. Nor do the results compare Dots to Muse or other agents under identical conditions. They serve to identify strengths and weaknesses, not to establish overall superiority.
The absence of a successful attack in a test does not mean that the risk is zero. The system fact sheet indicates that manual testing led OpenAI to strengthen its verification policies. It also acknowledges that certain scenarios remain difficult to reproduce and that the monitoring system may still miss high-priority behaviors. It is therefore prudent to treat Auto-review as a layer of defense, not as a guarantee.[5]
How Persistence Changes the Way We Work
A persistent agent can handle some of the behind-the-scenes coordination involved in digital work: monitoring inputs, reconciling documents, preparing versions, rerunning an analysis, or maintaining a to-do list. This continuity can free up time, but it can also shift the workload toward defining rules, validating data, and resolving errors.
The main risk is not necessarily the immediate replacement of a job. It lies in a more nuanced restructuring of activities. Tasks such as preparation, research, and updating can be further automated, while professionals retain responsibility for interpretation, decision-making, and accountability. If this division of labor is poorly designed, however, it may actually increase the number of alerts and fragment the agent’s attention.
Persistence also creates a form of organizational dependency. The more an agent knows about a team’s preferences, projects, contacts, and applications, the more costly it becomes to replace or migrate it. Context portability, the ability to export logs, and interoperability between vendors thus become economic issues, not just technical ones.
Finally, responsibility cannot be shifted to the product. A financial, contractual, medical, educational, or employment-related decision remains the responsibility of the individuals and organizations that define the process. A reference to human validation is only useful if the validator has the time, information, and authority necessary to reject the action.
Data, Security, and Legal Liability
Persistent memory is one of the most sensitive issues. A Dot can retain the context from conversations and applications for as long as it exists. Disabling ChatGPT’s memory stops new memory exchanges but does not delete information that has already been received. Upon launch, users cannot view, edit, or delete each item stored by their Dot individually. They must delete the Dot’s context, while files and conversations created in other spaces follow their own retention rules.[4]
Disconnecting an application prevents new access attempts, without automatically deleting the information already embedded in the context. This distinction between revoking access and deleting data must be understood before any professional deployment. It requires a retention policy, an inventory of data sources, and exit procedures when an employee changes roles or leaves the organization.[4]
For Business, Enterprise, and Edu plans, OpenAI states that content is not used by default to train its models. On a personal plan, the model enhancement setting determines whether Dot’s conversations and work can be utilized. Proactive research notes are not used directly, but information reintroduced into an eligible conversation may be used depending on the settings.[3][4]
In July 2026, the CNIL and the Council for AI and Digital Technology specifically identified the change in scale brought about by agent-based AI. Persistent memory, data flow between multiple services, and the ability to act on behalf of the user increase data volumes, complicate the understanding of data flows, and make the sharing of responsibilities more difficult. The principles of the GDPR remain applicable, particularly those regarding purpose, data minimization, retention periods, security, and access controls.[6]
The European regulation on artificial intelligence does not classify Dots as a high-risk system based solely on its name. The classification depends on its intended use. An agent used to draft a report does not automatically fall into the same category as a system designed to recruit, select candidates, assign tasks based on personal characteristics, or evaluate employee performance. In these areas, Annex III of the regulation sets forth enhanced obligations for certain high-risk systems.[7]
Finally, cybersecurity remains a structural constraint. An agent who reads web pages, emails, and documents may encounter malicious instructions. Compartmentalization, tool restrictions, and Auto-review reduce this risk, though they do not eliminate it. Organizations must monitor observable actions, avoid accounts with excessive privileges, and maintain a shutdown procedure that is independent of the agent.
The Conditions for Effective Delegation
Responsible deployment begins with a clearly defined role. The agent must be assigned a verifiable mission, identified sources, and permissions consistent with that mission. Read access must not be converted into write access for the sake of convenience, and a one-time approval must not be interpreted as a permanent mandate.
| Governance Decision | Issue to be resolved before deployment |
|---|---|
| Identity | Does Le Dot operate using an employee’s account or with a separate, identifiable, and revocable identity? |
| Access | What data is essential, and what read, write, or share permissions are required? |
| Duration | When should permissions, sessions, and context expire or be reviewed? |
| Validation | Which actions require confirmation at the exact moment of execution, and which ones should remain human? |
| Traceability | Can we reconstruct the objective, the sources consulted, the tools used, the validations, and the result? |
| Recovery | How do I stop a job, cancel an action, restore a version, or report an incident? |
| Assessment | Are we measuring the entire task, human rework, silent errors, and the total cost? |
In the initial phase, read-only or draft-generating use cases provide a more manageable testing ground. The organization can then expand the scope if the logs demonstrate sufficient reliability and if the teams are able to take over. This progression must be based on the potential consequences of an error, not solely on the technical ease of adding a connector.
Supervision must also remain proportionate. Requiring confirmation at every step negates part of the expected benefit. Allowing all actions eliminates useful checkpoints. The right balance lies between these two extremes, with thresholds defined based on the sensitivity of the data, the reversibility of the action, and its impact on third parties.
What to Watch for Now
The first question concerns real-world use cases. OpenAI’s demonstrations illustrate what the product is capable of, but they do not yet measure real-world reliability, the supervision burden, or silent errors. Independent evaluations will need to compare the agents across long-term projects, with changing permissions, imperfect interfaces, and measurable consequences.
The second question concerns memory controls. The ability to delete the entire context is an important mechanism, but the lack of granular inspection and correction limits control over what the agent retains. The evolution of these features will be crucial for companies subject to data protection, audit, or professional confidentiality requirements.
The third issue is economic. OpenAI plans to offer multiple Dots and scalable computing capabilities, though it has not yet specified the full pricing details. The calculation will need to factor in subscriptions, connectors, tool calls, monitoring, incidents, training, and the cost of relying on a context that is difficult to port.
Finally, the expansion into the European Economic Area and how the product will be adapted to local requirements will need to be monitored. Dots makes the transition from chatbot to agent with ongoing responsibility a tangible reality. Its usefulness will not be measured by the number of applications it can handle, but by organizations’ ability to limit its permissions, understand its memory, verify its actions, and clearly assign responsibility when the context changes.
To learn more
To understand how OpenAI Dots fits into the evolution of agents capable of taking action, maintaining context, and integrating with professional tools, check out these analyses from the aivancity blog.
Sources
[1] OpenAI. (September 29, 2026). Introducing dots. View source
[2] OpenAI Help Center. Getting started with your dot. Accessed October 4, 2026. View the documentation
[3] OpenAI. (September 29, 2026). How we build safety, security, and privacy into dots. View source
[4] OpenAI Help Center. Dots privacy, security, and safety FAQs. Accessed October 4, 2026. View the FAQ
[5] OpenAI. GPT-6 Astra System Card. Dots Appendix added on September 29, 2026. View the safety data sheet
[6] CNIL and the Council for AI and Digital Technology. (July 20, 2026). Agent-based AI and Personal Data, exploratory note. View the note
[7] European Union. Regulation (EU) 2024/1689. Consolidated version as of July 27, 2026, Article 6 and Annex III. View the regulation at
[8] Roth, E. (September 29, 2026). OpenAI launches Dots, its Muse competitor. The Verge. View the article