OpenAI Dots: always-on AI agents with their own cloud PC — what actually ships
At DevDay on September 29, 2026, OpenAI announced Dots: persistent, always-on agents powered by GPT-6 Astra, each with its own cloud computer, that keep working on your behalf between conversations. The details that matter are in the permission model, not the launch film.
- What a Dot is — Per OpenAI's September 29 announcement, a Dot is an always-on agent powered by GPT-6 Astra with its own cloud computer and browser, connectable to over 4,000 apps through ChatGPT's plugin ecosystem, reachable in ChatGPT, Slack and Teams (texting announced as coming soon).
- Who gets it — Dots roll out first on Pro and Business Premium plans in eligible markets; Enterprise, Edu and Healthcare workspaces can enable the beta (off by default). The first Dot is included in the plan at no extra cost, and Dot conversations do not count toward ChatGPT usage limits — but tasks delegated to Codex or ChatGPT Work do.
- The permission model — Background 'proactive research' runs with read-only tools that cannot send messages or change app content; actions that affect your accounts pass through a separate Auto-review safety system before they run, and sensitive steps like changing a password always stay with you.
Every AI agent announcement of the last year has had the same shape: a chat window that can call tools, with a demo video of a task finishing while you watch. OpenAI's Dots, announced at DevDay on September 29, 2026, break that shape. A Dot is not a session. It is a persistent agent that keeps a context, runs on its own cloud computer, and keeps working between conversations — OpenAI's framing is an assistant that brings you work "sometimes before you even think to ask."
Dots were announced the day before this article. Everything below comes from OpenAI's own announcement and safety documentation, both published September 29, 2026, plus the DevDay recap. There are no independent reviews yet and no long-term usage reports. Product behaviour and plan eligibility are exactly as OpenAI describes them; whether the experience matches the description is untested territory. Treat this as a careful reading of the spec sheet, not a hands-on verdict.
What a Dot actually is
Per OpenAI's announcement, each Dot is powered by GPT-6 Astra, runs on its own cloud computer with its own browser, and can connect to over 4,000 apps through the ChatGPT plugin ecosystem. You can open the Dot's computer at any time to inspect its work. You can also grant it access to your own laptop, where it can use local files and installed tools alongside you — a connection that stays subject to the local sandbox and applicable action checks.
The interaction surface is deliberately ordinary: message or voice-call your Dot in ChatGPT on desktop, web and mobile; reach the same Dot in Slack and Teams, with texting announced as coming soon. The Dot carries its context across channels, so a project started in ChatGPT can be followed up in Slack without re-explaining it.
The work examples OpenAI gives are continuous rather than one-shot: watching customer feedback and preparing tested bugfix PRs with demo videos attached; reworking launch materials when product scope changes; rerunning analyses when new data arrives; updating an enterprise proposal as requirements shift. In OpenAI's own telling, an early tester's Dot noticed he had forgotten to invoice a publication, prepared the invoice, and sent it after his approval. Note the pattern in every example: the Dot prepares, a human approves.
What it costs and who gets it
Dots are rolling out to Pro and Business Premium users in eligible markets. Enterprise users, including Edu and Healthcare, can try the beta when a workspace admin enables it — it is off by default there, which is the right default for organisations with review obligations.
Your first Dot is included in your Pro or Business Premium plan at no extra cost, with an allowance for deeper work and extended limits for the first month after launch. Two usage details matter more than the headline price: conversations with your Dot do not count toward your ChatGPT usage limits, but when your Dot starts or manages tasks in Codex or ChatGPT Work, those tasks count as usual. OpenAI says future options will let you add more Dots and scale each one's output by speed or monthly work volume — pricing for those is not published.
The permission model, which is the real story
An always-on agent with app access is an always-on blast radius, and OpenAI's documentation is unusually explicit about the containment layers. Four are worth understanding before you connect anything:
- Read-only background initiative. When you are not actively working with it, a Dot runs "proactive research" — background tasks that look for ways to help — using connected apps through tools restricted to read-only in code. Those tasks cannot send messages, change app content, or control a browser or computer. Any follow-up action goes through the normal rules and checks.
- Auto-review before consequential actions. Before steps like sending emails or changing files, a separate safety system called Auto-review checks the planned action against your instructions, your Custom Rules, and safety requirements — for an email, that includes the recipient and the message. If it blocks a step, the action does not run and the Dot is told why. OpenAI keeps the controls that enforce Auto-review outside the environments Dots can change, so a compromised or confused agent cannot turn the check off.
- Credentials stay out of the model. For supported sign-ins, the model is paused while you complete a secure login form that submits credentials without exposing them to the model's context; saved-password flows use a dedicated encrypted credential service. OpenAI is candid about the limit: a secret pasted into a readable message or document is still visible to the model.
- Sandboxed, isolated workspaces. Each Dot's cloud computer sandboxes code and tools, isolates users' cloud environments from one another, and keeps execution separate from the systems that enforce safeguards. Safety monitoring watches for harmful behaviour as tasks develop and can pause or stop a Dot's work; Activity View in the desktop app lets you follow, redirect or stop ongoing work.
On data: content from ChatGPT Business, Enterprise and Edu workspaces is not used to improve models by default. On personal plans, you control whether Dot conversations and work feed model improvement via the "Improve the model for everyone" setting. OpenAI states it does not train directly on proactive research threads or a Dot's notes to itself, though information brought into an eligible conversation may be used depending on your settings.
The honest caveat: this is a defensive architecture documented by the vendor, not an independent security audit. Prompt injection remains a named risk in OpenAI's own documentation — a malicious webpage, email or document trying to redirect the agent — and the mitigations described are layered checks, not proof of impossibility. OpenAI closes its safety post plainly: "Dots can still make mistakes."
Specialist dots: the enterprise play
Beyond your personal Dot, OpenAI previewed specialist dots: agents with their own identity, credentials and access to defined systems, provisioned to take on well-defined responsibilities inside an organisation. OpenAI says it is building on lessons from early internal testing across procurement, invoice processing, email marketing, customer support and commercial contracting, and that it is starting with focused enterprise pilots where OpenAI engineers define each Dot's responsibilities, tools and human review points directly with the customer. OpenAI is also working with Microsoft to integrate specialist dots with the governance and security controls of Microsoft Agent 365.
For individuals on Pro or Business Premium: connect one or two low-stakes apps first — calendar, notes — and watch the Activity View for a week before handing over anything with send rights or purchase paths. The included Dot costs nothing extra, and the read-only background research is the safest thing to evaluate first.
For teams on Enterprise: leave the beta off until you have written down which actions require human approval. Custom Rules let you allow specific actions, require approval, or block them — that mapping is your real security review.
For agent builders: the Auto-review pattern — a separate policy check outside the agent's control, with hard-locked sensitive steps — is the design to copy. It is the first mainstream product to treat "the agent proposes, an external system disposes" as a shipping requirement.
Bottom line: Dots are the first credible attempt at the "AI employee" form factor — persistent, proactive, and connected. The engineering interest is in the control plane: read-only initiative, out-of-band action review, credential isolation, and locked sensitive steps. Whether it earns trust is an empirical question that needs months of real use; what is already clear is the permission model other agents will now be measured against.
Prices and benchmark figures are standard published rates as of September 30, 2026 and can change without notice. Some outbound links may be affiliate links — see our disclosure. Found an error? Tell us and we'll correct it in public.