Always-on agents like OpenAI’s Dots are genuinely useful for recurring work, but the reliability maths is unforgiving. Small error rates compound over long unattended runs, and OpenAI’s own system-card figures show problems becoming more likely as task chains grow. The design I’d trust is boring on purpose: one narrow job per Dot, short stages, outputs kept as drafts, and a human checkpoint before anything leaves the building.
I don’t use ChatGPT, so I haven’t tried Dots. What I do have is Claude connected to my site, my email and GitHub, so the question of how much an always-on agent should be allowed to do applies to my own setup too.
What Dots Are
OpenAI describes Dots as always-on agents for ongoing work. Each one has its own cloud computer and browser, can use connected tools, can run recurring tasks on a schedule, and can be reached through ChatGPT, Slack and Teams, with texting listed as coming soon. Dots run on GPT-6 Astra, OpenAI’s most capable model, which has a 1.05-million-token context window and supports computer use.
The shift that matters is the mental model: from “ask an AI a question” to “give an AI a bounded responsibility”. A persistent computer gives the agent somewhere to work, connected tools give it access, and schedules mean it doesn’t wait for your next prompt.
One detail I’d treat carefully: delegation to subagents appears in OpenAI’s safety documentation, but I didn’t find it in the launch announcement, so I wouldn’t plan around it until OpenAI documents it for users.
Who Can Use Them and What They Cost
| Rollout started | 29 September 2026 |
|---|---|
| Plans | ChatGPT Pro and Business Premium in eligible markets; admin-enabled beta for Enterprise, Edu and Healthcare; not announced for Free or Plus |
| Regional exclusion | The Next Web reports Pro users in the EEA, Switzerland and the UK are excluded for now; Business Premium gets them in all supported regions |
| Cost | The first Dot is included in the plan. Conversations with it don’t count toward usage limits, but tasks it starts in Codex or ChatGPT Work do |
| Model API prices, for reference | GPT-6 Astra $10 / $50 per million tokens; the cheaper GPT-6.1 Sol $2 / $10 |
Rollout is gradual, so check OpenAI’s help centre for current eligibility.
What OpenAI’s System Card Reveals
These findings come from OpenAI’s GPT-6 Astra system card as reported by The New Stack. I haven’t read the card itself.
- Longer chains, more problems. When OpenAI doubled a chain of tasks from five to ten, the share of runs flagged for boundary problems rose from 8.6% to 19.7%. OpenAI found no high-severity breaches or data exfiltration, but hasn’t said what the flagged problems were.
- Agents can over-grant access. In a separate simulation of internal Codex traffic (not Dots), a model asked to build an hourly helper enabled every available action and turned off per-action approval.
- Prompt injection is reduced, not solved. OpenAI reports a 99.79% defender success rate in its own tests; external testers at Gray Swan estimated an 8.5% attack success rate over 15 attempts per scenario with safeguards on.
- Audit trails are unclear. Saved passwords aren’t exposed to the model, but OpenAI hasn’t said whether a Dot’s actions in services like GitHub or Slack are logged under your identity.
The second point worries me most. An agent that quietly widens its own permissions is exactly what always-on setups need to guard against, so re-check permissions as new tasks arrive, not just at setup.
Our Calculation: Why Long Unattended Runs Fail More Often
Method: we couldn’t test Dots, which needs a ChatGPT Pro or Business Premium plan in an eligible country. Instead, on 15 October 2026 we did two calculations in Python (with AI assistance) to show what always-on, multi-step work means for reliability. They are arithmetic, not measurements of Dots.
1. Checking OpenAI’s own numbers
If each task carried the same independent risk, 8.6% over five tasks implies about 1.8% per task, and ten tasks would be flagged about 16.5% of the time. The reported 19.7% is higher. In plain terms, problems became somewhat more likely per task as the chain grew, not just more numerous.
2. How small error rates compound
| Chance each step goes right | 5 steps | 10 steps | 20 steps | 50 steps |
|---|---|---|---|---|
| 99% | 95% | 90% | 82% | 61% |
| 98% | 90% | 82% | 67% | 36% |
| 95% | 77% | 60% | 36% | 8% |
That’s the chance a whole run finishes without a single mistake. A daily 20-step job at 98% per step would contain at least one error on about 10 days in 30. Add a human checkpoint every five steps that catches a mistake and allows one retry, and the clean-finish rate rises from 67% to 96% at 98% per step, and from 36% to 81% at 95%.
How I’d Design a Dot
- One responsibility. “Prepare the Monday sales brief”, not “help with sales”.
- Named sources. Tell it exactly which documents, apps and data it may use.
- A fixed output format. Repeatable outputs are far easier to review.
- A written approval boundary. Let it read, research, analyse and draft on its own; require approval to send messages, delete records, spend money, publish or merge code.
- A trigger and short stages. A schedule or event starts it; checkpoints keep each stretch short.
Example: a daily operations brief
- A schedule starts the Dot each morning.
- It checks approved sources and the connected project workspace.
- It flags contradictions between them.
- It produces a short brief with source links.
- Any message to colleagues or customers stays a draft until a person approves it.
Where to use the cheaper model
Not every step needs Astra. If you’re building similar agents through OpenAI’s API, a sensible split is Astra for planning and final review and GPT-6.1 Sol for repetitive classification, extraction and formatting. Sol costs a fifth of Astra per token.
Four Workflows That Fit Well
- Launch coordination: summarise blockers from approved sources and draft follow-ups for approval.
- Research digests: gather updates from approved public sources into a dated, cited brief.
- Engineering triage: reproduce suitable bugs in an isolated environment, prepare a fix and open a pull request for review.
- Meeting follow-up: turn transcripts into decisions and action items, leaving unclear owners for a person to confirm.
What Dots Don’t Fix
Persistent agents still hit ambiguous instructions, changing websites, bad data and permission errors. And there’s a difference between access and authority: connecting a service gives an agent a way in, not a licence to do everything there. Benchmarks aren’t guarantees for your workflow, so start with one repetitive job, measure how often it’s right, and only then add tools.
FAQ
What are OpenAI Dots?
Always-on agents in ChatGPT with their own cloud computer and browser, connected tools and recurring tasks, powered by GPT-6 Astra.
Can a Dot work while my laptop is closed?
Yes. It runs on its own cloud computer, not your local browser.
Are Dots available on ChatGPT Plus?
No. They launched for Pro and Business Premium in eligible markets, with a beta for Enterprise, Edu and Healthcare.
Are Dots fully autonomous?
They can run on their own, but I’d keep approval rules for anything with external consequences.
Related: AI agent infrastructure · System 1 vs System 2 agents · AI agent safety
More from EvalAITools: OpenAI’s text watermark explained · AI agent infrastructure · System 1 vs System 2 agents
