ChatGPT Dots Explained ⚡ Costs, Risks & AI Agents
Discover ChatGPT Dots: AI agents and ChatGPT integrations that are always-on. Learn costs, AI agent security risks, and best practices before you enable.
ChatGPT Dots: What an Always-On AI Agent Can Really Do
An AI assistant that checks your inbox, updates your calendar, and handles routine tasks while you're away sounds handy. It also means granting software ongoing access to personal accounts - and betting that it'll understand which details matter. That's the trade-off behind ChatGPT Dots, OpenAI's attempt to turn ChatGPT into an always-on personal agent.
Dots are meant to keep working between conversations. They run on a cloud computer, connect to apps like email and calendars, and can reach out when they need input or approval. In practice, that makes them more than a prompt-and-response chatbot. It also raises the bar for reliability and security - because they're not just "talking," they're acting.
Hands-on testing reported some useful wins: Dots flagged payment problems, noticed conflicting deliveries, and helped troubleshoot a broadband login. They also missed messages that required judgment. This guide walks through what Dots are, how they work, where they're useful, and why you should be cautious before letting one handle important work unattended.
What are ChatGPT Dots?
ChatGPT Dots are OpenAI's always-on AI agents. You interact with a Dot through ChatGPT, but it's built to do more than answer questions in a chat window. It can use a cloud computer, connect to selected apps, and keep working even when your laptop is closed. If it needs your approval - or it detects something it treats as urgent - it can contact you.
The key difference is persistence. A standard chatbot usually waits for your next prompt. An always-on agent can retain context between conversations and look for tasks across connected services. That might mean spotting a calendar change, checking new email, or following up on something you asked it to do earlier.
This broader category gets a few names - personal agents, always-on agents, and sometimes "Claws." The label matters less than the setup: an AI system with tools and access can do things, not just generate text. As Simon Willison has described this class of software, it's essentially a coding agent applied to broader work. The shift is from producing an answer to carrying out a workflow.
What OpenAI says a Dot can do
OpenAI's examples describe a Dot that can:
- Review connected email, calendar, and Slack activity and flag relevant updates.
- Send a morning calendar briefing and revise it when appointments change.
- Monitor bug reports, investigate recurring issues, and prepare fixes for review.
- Update an analysis as new information arrives.
- Draft an invoice and an email, then send them after you approve.
These examples show what OpenAI is aiming for, but they don't guarantee every task will work the same way every time. A system can be able to open an app or draft a message and still miss what's actually going on. That gap matters when you're deciding whether to use a Dot for business or personal work.
Why this matters for businesses
For a business, the promise isn't just "more AI." It's fewer handoffs in routine processes - collecting information, deciding what needs attention, and preparing the next step. A Dot that reliably handles a narrow, repetitive workflow can save staff time. But if it overlooks an important exception, it can easily create more work - or cause a costly mistake.
Treat Dots like a possible layer in your process, not a replacement for the process. Before connecting one to a shared inbox or a customer system, be clear about what it can read, what it may change, and which actions still require a person.
How do ChatGPT Dots work?
Each Dot runs on a cloud computer, so it can keep working when your device is offline. The described setup includes a Linux environment and a Chrome browser, which the agent can use to browse the web, interact with tools, create files, and write code. You can watch what it's doing and, in some cases, take over - for example, to enter a password or provide payment details.
Dots can also work with desktop apps and local files, depending on what you connect and allow. They can process more than text, too: images, screenshots, and documents can be part of the context. That gives the agent more to work with, but it doesn't remove the need to verify that its interpretation is right.
App connections and permissions
Dots use ChatGPT's app connection system. If you've already connected an app to ChatGPT, the Dot may use that same connection. New connections can include services such as Gmail, Google Calendar, and Slack, with additional apps available through integrations. You can learn more about connecting ChatGPT with other apps.
An integration isn't just a convenience toggle. It defines what information the agent can see and - depending on the connection - what it can do. Existing permissions and approval settings matter, but you should still check what access each app really grants. Don't assume a familiar integration is harmless just because you've used a chatbot with it before. An agent that can act repeatedly has a different (and higher) risk profile than one that only answers questions.
Proactive research and approvals
If you haven't assigned a specific task, a Dot may do what OpenAI calls proactive research: reviewing connected apps and looking for ways it can help. It can also ask for approval before significant actions, like sending a message, changing a document, or using a payment method.
That approval step is helpful, but it isn't a complete safety model. In testing, the agent reportedly sent an email after approval had already been granted for an earlier message in the same thread. The exact behavior may depend on the workflow and settings, but the lesson is practical: review permissions and approval rules, and don't assume every consequential action will trigger a fresh confirmation.
What does hands-on testing reveal?
The reported test connected a Dot to a real Google account and let it monitor day-to-day activity. The results were mixed in a useful way: it handled several concrete tasks well, while its misses pointed to a weakness that matters more than a polished demo.
Where Dots were useful
The Dot reportedly flagged bounced card payments, noticed a possible clash between deliveries, and identified that an email from a builder didn't meet the requirements for a grant application. It also updated calendar events, found alternative restaurant reservations after a booking was cancelled, and helped investigate a broadband provider login problem.
Some tasks were initiated by the agent; others were assigned directly. That difference matters. A proactive alert isn't the same as successfully completing a task after a person explains the goal. Both can be valuable - but they show different capabilities.
The strongest results were in routine, bounded work: watching predictable notifications, collecting details, and carrying a task through multiple steps. Logging into services that required email verification codes is another example of the agent working through an actual process, not just telling you what to do.
Where Dots fell short
The biggest weakness was prioritization. The Dot reportedly surfaced payment alerts and delivery notifications that were already obvious from their subject lines, but it missed a more consequential email asking the user to pause work on an assigned article. Spotting that message required understanding the context and judging its importance - not just detecting that "a notification arrived."
This is the gap between activity and assistance. A system can scan lots of messages and still fail to bring forward the one that changes what you should do next. And there's a darker side: a quiet agent can create false confidence. If it has been surfacing alerts, you might assume that no alert means nothing important happened.
So a fair test should measure more than how many tasks it completed. Ask:
- Did it spot the items that actually changed priorities?
- Did it separate urgent messages from routine notifications?
- Could you see what it read and what action it took?
- Did its mistakes cause extra work or real operational risk?
- Would a human reviewer catch the errors before they mattered?
The test didn't report a dramatic failure, but that's not the same as proving dependable autonomy. For now, Dots look better as an assistant that prepares and flags work than as the sole manager of an inbox, calendar, or business workflow.
Are ChatGPT Dots safe, and what do they cost?
An always-on agent needs access to information to be useful. That can include private messages, schedules, documents, and connected accounts. It may also interact with the open web, where content can be misleading or intentionally designed to influence an AI system. This isn't just theory: prompt injection attacks exploit instructions hidden in content an agent reads.
OpenAI's safeguards aim to reduce harmful actions, but they don't eliminate risk. A message could try to persuade an agent to disclose sensitive information or take an unauthorized action. The more systems an agent can reach - and the more autonomy it has - the more important it is to limit permissions and keep an eye on what it's doing.
A practical safety setup
Before connecting a Dot to an account you rely on, use a staged approach:
- Start with low-risk apps. Avoid giving broad access to financial accounts or sensitive company systems during initial testing.
- Grant only necessary permissions. If the task only needs reading a calendar, don't enable unrelated actions if the service offers finer controls.
- Require approval for consequential actions. Sending external messages, changing records, and spending money should get explicit review until the system has earned more trust.
- Review what it can access. Check existing ChatGPT connections as well as any new ones you add for the Dot.
- Check data settings. The source information says personal plans allow model training on data by default, with an option called "Improve the model for everyone" to turn it off. Business and Education plans have different defaults. Verify the current setting before connecting personal or company data.
- Keep a human review path. Make sure you can inspect what the agent did and take over when context is unclear.
For organisations subject to privacy rules like GDPR, the question isn't just whether an agent is useful. You also need to understand what data it processes, who can access it, and whether your policies allow the proposed connection. Loop in the relevant security or privacy owner before you use it on sensitive workflows.
Availability and pricing
The reported launch pricing and availability depend on plan tiers and may change as OpenAI expands access. At the time described:
| Plan | Availability | Reported price |
|---|---|---|
| ChatGPT Pro | Available to eligible subscribers; first Dot included | $100, $200, or $500 per month, depending on tier |
| ChatGPT Business Premium | Available; first Dot included | $125 per user monthly, or $100 per user monthly when billed annually |
| Enterprise and Education | Opt-in beta | Custom pricing |
| Free, ChatGPT Go, and ChatGPT Plus | Not available in the described rollout | Not applicable |
The first Dot was included in eligible plans, and its usage reportedly didn't count toward normal limits. That doesn't mean the arrangement will stay the same. OpenAI has said it's exploring multiple Dots, but you should check current plan information for future availability and pricing rather than assuming it will match launch terms. Access can also vary by region and rollout stage, so confirm what's available in your account.