OpenAI's always-on dots agents: what to let them do alone, and what to keep for yourself

On September 29, OpenAI used its DevDay event to launch dots, which it describes as "remarkably capable, always-on agents built to handle everything." Unlike a chatbot that waits for your next prompt, a dot keeps working in the background, watches the apps you connect, and can prepare work before you ask for it. That raises a practical question for anyone who gets access: if an AI agent can work on your behalf around the clock, what should it be allowed to do on its own, and what should always wait for you?

The short answer

OpenAI has given dots a three-way permission switch (allow, require approval, block) plus a read-only mode for background research. The sensible way to use it is to let the agent read and prepare freely, make anything that leaves your hands wait for approval, and block actions you could not easily undo. The controls are real, but they are only as good as the rules you write, and OpenAI itself says dots can still make mistakes.

What OpenAI actually launched

According to OpenAI's announcement, dots are powered by its GPT-6 Astra model, run on their own cloud computers, and can "readily connect to over 4,000 apps" through the company's plugin ecosystem. You can message a dot in ChatGPT, Slack and Teams, "with texting coming soon." OpenAI also says the agent adapts to you over time: "The more you work together, the more your dot learns your preferences, how you think, and what good looks like to you."

Access is limited for now. Dots are "rolling out today in ChatGPT to Pro and Business Premium users in eligible markets," and Enterprise workspaces, including Edu and Healthcare, can try a beta if an admin enables it. The first dot is included in those plans at no extra cost. 9to5Google reports that a dot must be created in the ChatGPT desktop app, though you can talk to it from mobile afterwards, and that OpenAI plans to let users add more dots in the future.

TechCrunch describes dots as "pursuing user-defined goals continuously in the background with minimal oversight," and Yahoo Finance frames the launch as a challenge to Meta's Muse agent. The competitive race matters less to most readers than the design choice underneath it: an agent that acts proactively needs a different kind of supervision than one that only answers questions.

The controls, in plain terms

OpenAI's launch page describes four layers of control. Each one addresses a different risk.

1. Custom Rules: allow, approve or block

"Custom Rules let you allow specific actions, require approval, or block them." You also choose which apps a dot can reach, using the app controls ChatGPT already has. This is the most important setting, because it decides where the agent's independence starts and stops.

2. Read-only proactive research

When a dot researches in the background without being asked, OpenAI says it uses connected apps "with tools that are restricted to be read-only, which means that they can't send messages, change app content, or control your browser or computer." Unprompted work, in other words, is limited to looking rather than doing.

3. Auto-review and hard limits

Dots "use auto-review to check actions that could affect your accounts or share information against your instructions, Custom Rules, and safety requirements." Some tasks never leave your hands at all: "Certain sensitive tasks, such as changing a password, always stay with you."

4. Visibility

You can "follow progress, including background work, in Activity View," and, according to 9to5Google, watch a dot's cloud computer while it works. You can also give a dot permission to use your own laptop, which is a far bigger grant than letting it work on its separate cloud machine.

A practical way to set the rules

The controls are generic; the judgement about how to use them is yours. A useful test for any action is two questions: does it leave my hands? and can I undo it?

• Allow on its own: reading, searching, summarising, drafting and preparing work inside the dot's own workspace. Mistakes here cost you review time, not money or reputation.
• Require approval: anything that reaches another person or system, such as sending an email or chat message, posting, editing a shared document or submitting a form. OpenAI's own showcase example follows this pattern: an early tester's dot "noticed he'd forgotten to invoice a publication, prepared the invoice, and sent it after his approval."
• Block: actions that are hard or impossible to reverse, such as payments, deleting files or records, changing account settings, and anything involving credentials. Think twice, too, before granting access to your personal computer.

Two further habits reduce risk. First, connect only the apps a given job needs; 4,000 available integrations is a ceiling, not a target. Second, keep standing instructions narrow. That advice comes from OpenAI's own November 2025 explainer on prompt injection, which calls the attack "a type of social engineering attack specific to conversational AI" and warns that "Giving an agent a very broad instruction such as 'review my emails and take whatever action is needed' can make it easier for hidden malicious content to mislead the model." The same page recommends: "Where possible, limit an agent's access to only the sensitive data or credentials it needs to complete the task."

Why always-on changes the risk

A chatbot's mistakes usually happen while you are looking at the screen. An agent that works around the clock can act while you are away, and it reads a steady stream of content written by other people: emails, messages, documents and web pages. Any of those can contain text crafted to steer it. The read-only restriction narrows that exposure for proactive research, but for tasks you assign, what the agent can do depends on the app access and rules you have set.

This is why security groups now treat agents as a category of their own. The OWASP Top 10 for Agentic Applications for 2026, published in December 2025, presents itself as a peer-reviewed framework covering "the most critical security risks facing autonomous and agentic AI systems," developed with more than 100 industry experts. The practical lesson from that work and from OpenAI's own guidance points the same way: limit what an agent can touch, and keep a person in the loop for consequential steps.

OpenAI puts the bottom line plainly on its launch page: "Dots can still make mistakes, so always review consequential work."

What we know vs. what we're inferring

What we know, from OpenAI's announcement and launch-day reporting:

• Dots began rolling out on September 29, 2026, powered by GPT-6 Astra, for Pro and Business Premium users in eligible markets, with an Enterprise beta.
• They come with Custom Rules (allow, approve, block), read-only proactive research, auto-review, Activity View and optional access to your laptop.
• Sensitive tasks such as changing a password always stay with the user.
• OpenAI says dots can make mistakes and that consequential work should be reviewed.

What we're inferring:

• The allow/approve/block split suggested above is our recommendation, not an OpenAI default.
• We have not tested dots ourselves, and we did not find published figures on how reliably auto-review catches unwanted actions.
• The announcement does not list which countries count as "eligible markets," so check availability in your own account.

What to watch next

• Texting support: OpenAI says it is "coming soon," without a date.
• Limits after the first month: plans include "extended limits for the first month after launch," so the standard allowance should become clearer from around late October 2026.
• Specialist dots for organisations: OpenAI is "starting with focused enterprise pilots" to define "each dot's responsibilities, the tools it can use, and how people review and approve its work," and is working with Microsoft on integration with governance and security controls in Agent 365. No timeline has been given.
• More than one dot per user: additional dots are planned, which will make careful permissions across several agents more important.
• Independent testing: the most useful signal will be third-party security research on how dots handle hostile content in real inboxes and documents.

Educational information only.