An always-on AI agent is a helper that keeps working for you even when you close the chat. OpenAI just launched one, called a “dot.” It can read your apps, draft work, and act for you around the clock. So the big question is simple: is an always-on AI agent safe to give access to your work?
The short answer: it is safer than a free-for-all, but not safe enough to run on autopilot. Here is what dots do, what the safety controls cover, and what they leave out.
What Is an Always-On AI Agent?
An always-on AI agent is software that keeps working in the background, remembers your past chats, and uses your apps for you, instead of waiting for you to type each question.
Think of a normal chatbot as a person you text. It answers, then goes quiet. An always-on agent is more like an assistant sitting at a desk. It can check your projects, prepare drafts, and wait for your OK before it sends anything important.
It is a newer idea than the chatbots most people know. If you want the bigger picture, our guide to what happens when AI agents talk to each other shows where this is heading.
What Are OpenAI Dots?
A dot is OpenAI’s name for a personal always-on agent inside ChatGPT. Each dot has its own cloud computer, its own web browser, and links to more than 4,000 apps.
According to eesel AI’s summary of the launch, OpenAI announced dots on September 29, 2026. Each one runs on the GPT-6 Astra model. (Astra’s follow-up version was cancelled, as we explained in why OpenAI cancelled GPT-6.1 Astra.)
Here is what a dot can do, based on OpenAI’s launch details:
- Research a topic and write a first draft.
- Update documents and proposals.
- Study customer feedback.
- Prepare social posts, but not publish them.
- Run scheduled or repeating tasks.
- Work inside Slack and Microsoft Teams.
- Remember things across many conversations.
It can also do “proactive research.” That means it reads and studies things between your chats, with read-only access. Read-only means it can look, but not change anything.
Who Can Use It, and What Does It Cost?
Dots are not for everyone yet. They are limited to higher-priced ChatGPT plans, and the first dot is included at no extra charge.
Reports differ slightly on the details, so check OpenAI’s own page before you pay. Here is what the coverage says:
- Dots are available on ChatGPT Pro (reported at $100 to $500 a month) and Business Premium. IT Brief adds that Enterprise customers in eligible markets can get a beta if their administrators turn it on.
- Free, Go, and Plus plans do not get dots.
- Pro users in the European Economic Area, Switzerland, and the UK are left out at launch.
- Talking to your dot does not use up your normal ChatGPT limits. Delegated work in Codex or ChatGPT Work does count.
- Extra dots and speed upgrades will have prices “in the future.” Nothing is announced yet.
Is an Always-On AI Agent Safe? What the Controls Cover
OpenAI built a permission system with firm limits on the riskiest actions. It lowers the danger, but it does not remove it, and OpenAI says so itself.
Here are the main controls:
- Hard stops. Changing a password or moving money always needs you to take over and do it yourself.
- Approval for risky steps. Deleting data for good or installing software may need your OK each time. Buying something with a card saved on a shop’s site needs your approval.
- Custom Rules. You can set four behaviors for any action: ask me, pre-approve it, just do it, or hand it back to me.
- Auto-review. Before a dot sends an email or changes a file, a checker looks at it. For example, it checks the address and message to catch a wrong recipient.
- Small approvals stay small. Saying yes to one message does not give the dot permission to contact people from then on.
A developer write-up of the documentation walks through the same permission model in more detail.
What Are the Real Risks of Always-On Agents?
The biggest risks are tricks hidden in content the agent reads, mistakes the agent makes by itself, and memory you cannot fully control.
1. Prompt injection
Prompt injection means someone hides instructions inside text the agent reads, like an email or a web page. The agent may follow them as if you wrote them. We showed how this works in our article on hidden text in emails. OpenAI states that its defenses “help reduce the risk” but “do not eliminate it.”
An agent that reads your inbox all day sees far more text from strangers than a chatbot does. That gives tricksters more chances.
2. Honest mistakes
OpenAI’s own advice is blunt: dots “can still make mistakes, so always review consequential work.” A wrong number in a sales proposal is still wrong, even if a machine wrote it.
3. Memory you cannot edit
Per the eesel summary, you cannot view, edit, or delete single memories in a dot. The only way to wipe its memory is to delete the whole dot. If it remembers something wrong, you cannot fix just that part.
How Do You Use a Dot Safely?
Start with the lowest access that still gets the job done, and widen it only after the agent earns your trust.
- Connect only the apps it needs. A dot that cannot see your bank app cannot leak it.
- Set sending and deleting to “ask me.” Treat “just do it” as a reward, not a starting point.
- Read drafts before they go out. Check names, numbers, and addresses.
- Keep secrets out. Do not tell any agent passwords, ID numbers, or private client data it does not need.
- Review its work weekly. Look at what it did while you were away.
Frequently Asked Questions
What is an OpenAI dot?
A dot is a personal AI agent inside ChatGPT that works in the background. It has its own cloud computer and browser, remembers past chats, and connects to more than 4,000 apps through plugins.
Can a dot spend my money?
Not on its own for the biggest actions. Moving money always needs you to take over. Purchases with a card saved on a merchant’s site need your approval, though you can approve a specific purchase in advance.
Is an always-on AI agent safe from hackers?
Not completely. Hidden instructions in emails or web pages can still trick agents. OpenAI says its defenses reduce this risk but do not remove it, so keep approvals on for anything important.
Can I use dots on a free ChatGPT plan?
No. At launch, dots are for ChatGPT Pro and Business Premium, with an Enterprise beta in eligible markets. Free, Go, and Plus plans are not included, and some regions are left out.
Can I delete what my dot remembers?
Only all at once. Reports say you cannot edit single memories. Deleting the whole dot is the only way to clear its memory.
