OpenAI Dots puts always-on work behind permissions and reviews

Dots are a persistent agent, not just another chat tab

OpenAI introduced Dots on September 29 as agents that can keep working between individual prompts. The company says each Dot runs on its own cloud computer, can learn from feedback, and can work toward a user’s goals around the clock. Users can reach it through ChatGPT, Slack, or Teams, and OpenAI says its plugin ecosystem can connect Dots to more than 4,000 apps. That describes the product ambition; it does not mean every app is available to every account or that a Dot can act in every connected app.

OpenAI’s examples include a Dot noticing that a user had not sent an invoice, preparing it, and sending it after approval. Other examples describe drafting launch materials or updating analyses when new evidence arrives. They are company-selected scenarios, not independent demonstrations of reliable performance. The useful product change is that the system can carry a task forward without the user writing a fresh prompt for every step.

Proactive research is meant to read, not to execute

OpenAI calls its background activity “proactive research.” The product announcement says these research tools use apps the user has already connected and are restricted to read-only access: they cannot send messages, change app content through plugins, or control the browser or computer. A Dot may therefore gather information and prepare a suggestion while no one is actively chatting with it, but this mode is not supposed to complete a write action by itself.

That separation is worth keeping clear when evaluating an always-on agent. A task can begin as a summary and later become a proposed action, but the permission boundary should change only when the user explicitly authorizes the next step. The Dots Help Center says the same restrictions apply when a Dot delegates or continues a task in the background. If a team is trying it, the first check is whether connected-source access is intentionally scoped, not whether the agent can automate the largest number of tasks.

Existing app permissions are shared across OpenAI products

The Help Center says Dots can use plugins already connected to ChatGPT, ChatGPT Work, or Codex, within the permissions the user has granted. Those connections are shared across the products, and a user can add a separate Slack account for a Dot if it needs its own identity. This is convenient for someone who wants an agent to work where their files already live, but it also means the setup should be reviewed as an account-level access decision.

OpenAI says the user chooses which apps a Dot can access and can use Custom Rules to allow particular actions, require approval, or block them. Those rules cannot override core safety requirements. For a business, that means a work trial should use the intended work account, least access needed for one task, and a clearly named operator. Connecting a wider set of apps just because they are available would make the agent’s data boundary harder to reason about.

Disconnecting an app does not erase context the Dot already has

The current Dots privacy FAQ says a Dot can receive memories and recent conversation context from ChatGPT, and conversations with a Dot can contribute to ChatGPT Memory. Turning Memory off stops future sharing but does not delete information the Dot has already received. The FAQ also says a Dot can keep context from conversations and plugins for as long as the Dot is kept; deleting the Dot deletes its own context, while files and conversations it created in other places follow those locations’ retention policies.

There is a similar distinction for connected apps. Disconnecting a plugin stops new access through that connection; it does not remove information already built into the Dot’s context. OpenAI says users cannot currently inspect or directly edit individual Dot memories, though they can delete the Dot’s context by deleting the Dot. For data-sensitive work, this is a more useful question than a broad claim that the agent is private: what information can it read, how long can its context persist, and what does deleting or disconnecting actually remove?

The FAQ says content from Business, Enterprise, and Edu workspaces is not used to train OpenAI models by default. On personal plans, the model-improvement setting controls whether Dot conversations and work may be used; OpenAI says it does not train directly on proactive research or Dot notes, but information may be used if it informs an eligible conversation or task, depending on settings. These are the company’s current policy statements, and they should be checked against the specific plan and agreement being used.

Some actions require a click; the most sensitive stay with the user

The release says Dots use a review system to compare planned actions with the user’s instructions, Custom Rules, and safety requirements. The Help Center is more specific: actions such as permanently deleting data or installing software may require approval each time, while changing a password or transferring money requires the user to take over. Some recurring messages can be approved in advance, but that approval is limited to what was authorized; approving one message does not grant an open-ended right to contact people.

OpenAI says Activity View lets users follow tasks, review steps, correct a misunderstanding, change direction, or stop the Dot. It also warns that a completed action may not be reversible. The system can make mistakes, and its review tools are designed to reduce unwanted outcomes rather than guarantee that they cannot happen. A sensible first trial is a read-and-draft task, followed by a low-impact action that can be checked and undone. Keep customer-facing messages, account changes, and purchases behind explicit review until the team understands what the Dot actually asks before proceeding.

The model OpenAI held back was not the model powering Dots

OpenAI’s product announcement says Dots are powered by GPT-6 Astra. The same day, the Associated Press reported that OpenAI had delayed a separate planned model release, GPT-6.1 Astra, after safety concerns. The company’s head of safety systems told AP that the model had become more persistent at completing tasks, but OpenAI needed to balance that ability against unauthorized behavior and it had not met the company’s safety bar.

Those are two distinct product facts. The delay was not an announcement that GPT-6 Astra, which powers Dots, had been withdrawn; nor does the existence of the more permissive Dot workflow prove that the held-back model’s behavior is present in Dots. The timing is still relevant. OpenAI was introducing an agent designed to act over time while publicly acknowledging that more persistent task completion can create scope and authorization problems if safeguards do not keep pace.

Test one workflow before asking the Dot to own a process

OpenAI says it is beginning rollout to Pro, Business Premium, and Enterprise users in eligible markets; it also previews specialist Dots for organizations, with their own identity and IT-provisioned hardware. A preview label and an eligible-market rollout are not the same as universal availability. The announcement does not provide a plan-by-plan connector matrix or promise that every capability works in each app.

For a first test, choose a low-risk, easy-to-check task such as collecting unread project updates and drafting a summary. Confirm which account the Dot uses, what sources it can read, and whether background research is limited to reading. Then test one action that needs approval and check the Activity View record. Before expanding the scope, read the data-retention terms, decide how the team will remove stored context, and write down what the Dot must always ask before doing.

The practical test is not whether the agent looks busy. It is whether it can move a specific task forward while keeping its source access, identity, approval steps, and retained context inside boundaries the user understands. Dots make that kind of background assistance more visible; they also make setup and follow-up review part of using the product.