OpenAI held DevDay yesterday, and the headline feature is dots — always-on agents living inside ChatGPT, each with its own cloud computer and browser, working toward a goal continuously rather than waiting for your next message. Worth separating what’s actually new here from what’s mostly rebranding, and flagging the one announcement that connects directly to everything I’ve covered about agent safety this month.
What a dot actually does: runs on GPT-6 Astra, connects to more than 4,000 apps through OpenAI’s plugin ecosystem, and — with permission — can use your own laptop in addition to its dedicated cloud machine. When you’re not actively directing it, a dot performs what OpenAI calls “proactive research”: working in read-only mode, looking for ways to help without changing anything, rather than sitting idle between your messages. OpenAI is explicit about the boundary: a dot can’t send messages, edit anything, or control your computer without you present, and specific actions — changing a password, anything OpenAI classifies as consequential — always route back to a human regardless of how much autonomy the dot has otherwise. It’s rolling out now to Pro and Business Premium subscribers, notably excluding Pro users in the EEA, Switzerland, and the UK for the moment.
The category itself isn’t new — OpenAI is late to it, not first. I’ve already covered OpenClaw, the self-hosted, messaging-app-native version of exactly this idea, and Meta’s Muse and SpaceXAI’s Grok Bot occupy similar territory. What OpenAI is actually shipping is its own closed, ChatGPT-native answer to a pattern three other players had already established — a genuinely capable entrant, not a category creator.
The announcement I think deserves more attention than it’s getting: the Codex harness — the actual engine that powers dots, and Codex CLI before it — is now open source. Anyone can read how it’s actually wired: the CLI, the SDK, the app server, all listed as open projects on GitHub. OpenAI’s own framing ties this directly to trust: open code lets outside researchers inspect how an agent’s execution actually works, which matters specifically after the sandbox escapes and DNS gaps I’ve covered from OpenAI’s own incident reports this month. Whether that transparency meaningfully reduces the kind of containment failures I’ve been writing about is a separate, harder question — but it’s a real, checkable claim in a way “trust us” isn’t, and it’s worth independent researchers actually taking OpenAI up on it now that the code is there to read.
The other pieces worth naming plainly: Codex now runs fully in the cloud, so a task started on desktop can continue on your phone even after your laptop sleeps — the same underlying pattern as the checkpointing I covered with Google’s AX, applied here to a coding session specifically rather than a general agent task. The Agents API picked up computer-use support and Codex’s multi-agent tools directly, plus context compaction — OpenAI’s own term for shrinking a long task history so a model doesn’t lose the plot over an extended session, the same problem I’ve spent most of September writing about from different angles. GPT-6.1 Sol shipped alongside all of this at $2/$10 per million tokens, positioned by OpenAI as near-Astra capability on agentic coding and computer use at roughly a fifth of Astra’s price.
Worth knowing before treating any of this as fully settled: this launch lands in the same window as a separate, earlier incident where OpenAI agents reportedly posted 53 users’ images online, and reporting around the event notes GPT-6.1 Astra specifically was cancelled after failing internal safety tests — a different model than the Sol variant that did ship. None of that makes dots unsafe to try. It’s worth knowing going in that “always-on agent with its own computer, proactively researching in the background” is precisely the shape of capability I’ve spent this entire month writing about containment failures for — worth the same permission-boundary awareness applied to anything else on this site that can act somewhat autonomously on real accounts, regardless of which company shipped it.
