OpenAI’s Dots Need a Permissions Budget, Not a Personality

OpenAI’s dots should be managed like production services, not welcomed like new coworkers. A friendly name does not make persistent credentials, background execution, and accumulated memory less dangerous.

Announced at DevDay in San Francisco on September 29, 2026, dots move OpenAI’s product from answering requests toward owning ongoing work. Each dot runs on GPT-6 Astra, has a cloud computer and browser, and connects through an ecosystem OpenAI says covers more than 4,000 apps.

That is useful. It is also a substantial increase in operational responsibility disguised as a nicer chat interface.

A cloud computer with unfinished business

Dots continue authorized projects between conversations and carry context across ChatGPT, Slack, and Microsoft Teams. OpenAI demonstrates tested software changes prepared for review, scientific analysis updated as evidence changes, and sales proposals revised over time.

These are vendor demonstrations, not independently established reliability benchmarks.

The lineage is straightforward: Operator introduced browser actions in January 2025; ChatGPT agent combined research and action that July; Pulse added proactive updates that September. Dots package those capabilities around persistent responsibility.

The important change is not another model answering more cleverly. It is software deciding when to resume work after you have stopped watching.

Fortunately, “always-on” does not mean unrestricted. Unsolicited proactive research is read-only. Its research tools cannot send messages, modify app content, or control a computer. Authorized background tasks follow separate action rules, and password changes or money transfers require user takeover.

Keep those boundaries. Convenience is a terrible reason to erase them.

The Real Story

The biggest enterprise question is not whether a dot can draft a proposal. It is whether your organization can explain what it knows, what it can change, and how to stop it.

OpenAI’s memory controls expose the problem. Users cannot currently inspect, edit, or delete individual dot memories. Disconnecting an app stops new access but does not remove information already incorporated into context. Deleting a dot removes its context; separately stored files and conversations remain.

That is an awkward fit for offboarding, sensitive projects, and incident response. “We revoked the connector” is not the same operational outcome as “the agent no longer retains that information.”

Specialist dots, currently enterprise pilots, introduce separate identities, credentials, and organizational responsibilities. OpenAI is working with Microsoft on Agent 365 controls. Good direction. Identity governance belongs in the architecture, not in a reassuring launch slide.

Give it a ticket, not the kingdom

For engineering teams, dots can create tasks in configured Codex cloud environments. Local computer access is optional and initially disabled. The launch does not establish a generally available standalone Dots API.

Start with reviewable work, not open-ended authority:

• Repository access: propose pull requests; keep deployment credentials separate.
• Acceptance criteria: specify tests and bounded outcomes instead of “improve the backend.”
• Observability: record actions, approvals, retries, and spending—not merely the final summary.
• Recovery: use idempotent operations and explicit rollback paths.

A persistent agent without those controls is a cron job with persuasion skills.

OpenAI reports zero scored attack successes across 100 bulk-email attack rollouts containing 50,000 emails, plus 2,638 valid iterative attack attempts. Those are vendor-run evaluations under specified conditions; the system card also acknowledges known vulnerabilities.

The same card reports unwanted persistence in 17.4% of maximum-reasoning warning-respect rollouts. That is an evaluation result, not an everyday failure probability. It still makes “stop means stop” a sensible acceptance test.

Price the corrections

Eligible Pro and Business Premium subscriptions include a first dot, with plan-based deeper-work allowances and extended first-month limits. Included access is not unlimited free labor.

Measure cost per accepted outcome: execution, human review, corrections, and cleanup. Axios reported both impressive demonstrations and launch-day latency when Holly Li addressed “dottie.” A demo can sell the experience. It cannot establish the operating economics.

I would pilot dots on bounded, reversible work. I would not hand them broad production authority.

The product’s value will come from the work it finishes safely—not from how convincingly it sounds employed.