Skip to content
Agents of Humanity
About
Public preview. Results are preliminary (criteria v1.0, 30 Sept 2026). Tell us what we got wrong
AssistanthostedProprietary

ChatGPT

OpenAI · chatgpt.com

ChatGPT Plus is a closed, OpenAI-hosted assistant with agent mode, scheduled tasks, connectors, memory and custom instructions. Owners get self-service export, account deletion, a training opt-out and itemised saved memories. The agent cannot run or be restored outside OpenAI's service, and OpenAI controls models, base instructions and behaviour changes.

Portable10
Transparent25
Auditable17
Verifiable17
Modifiable30
Controllable25
Strengths
  • Manual self-service export while the account is active (P5 partial)
  • Saved memories are itemised, editable, deletable and versioned (M2, V3 partial)
  • Owner-added MCP tools without review via developer mode (M3 partial)
  • Connectors revocable individually (C5 partial)
Gaps
  • No restore path or provider-independent runtime; closed source (P1, P3, V1)
  • Locked to OpenAI models, with silent server-side model and behaviour changes (P4, M5)
  • Training on content by default; unbounded retention classes (C4, T3)
  • No tamper-evident action record (A1, A2)
Evidence

All 26 findings

Hosted service as documented on 2026-09-30. Terms of Use effective 2026-01-01. Default models are GPT-5.5 Instant/Thinking, with GPT-5.6 Sol rolling out. Web client. openai.com and help.openai.com returned HTTP 403 to automated fetches, so every OpenAI page was read from Internet Archive snapshots dated 2025-08 to 2026-09. The newest available snapshot was used for each page.

Portable · Can you leave, take the whole agent with you, and keep it alive?

10%
  • P1
    Owner-usable round trip

    Settings > Data Controls > Export emails a zip of chat history and account data, which can take up to 7 days to arrive, and the link expires after 24 hours. OpenAI documents no import or restore path, and no runtime outside OpenAI's service accepts the export.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Offer an export that is available within minutes of the request
    • Publish an importer or runtime not operated by OpenAI that restores the export as a working agent
    Fail
  • P2
    Complete export

    The documented export contains chat history, custom instructions and 'other relevant account data'. The documentation does not say it includes the chat-history memory synthesis (which the Memory FAQ describes as broader than the visible summary), scheduled tasks, agent browser sessions, or connector grants. Under G12, these classes count as missing.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Document a manifest of every state class and include memory, tasks, projects and GPT configuration in the export
    • Provide a way to re-link each integration without an OpenAI-registered client
    Fail
  • P3
    Runs without the provider

    ChatGPT runs only as an OpenAI-hosted service that needs an OpenAI account. The Terms reserve the right to suspend or terminate access and to discontinue the service. No exported agent can run with OpenAI unreachable.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Ship a runtime that runs the exported agent without any OpenAI service, account or licence
    Fail
  • P4
    Model independence

    ChatGPT offers only OpenAI models, chosen from OpenAI's model picker, and OpenAI routes between them automatically. There is no documented way to use a third-party or local open-weight model.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Let the owner configure any model that meets a documented minimum, including a local open-weight model, with all capabilities kept
    Fail
  • P5
    Exit survives termination

    The owner can take manual exports while the account is active, and the Privacy Portal accepts data requests from users who cannot log in. The Terms allow suspension or termination (for breach, legal reasons or risk) and discontinuation with advance notice, but they commit to no post-termination export window, and the Privacy Policy allows banned content to be retained under OpenAI's control. The exit therefore relies on a manual, discretionary route.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Commit in the Terms to at least 30 days of export after any termination, including bans
    • Publish a shutdown plan covering export of agent state
    Partial

Transparent · Can you see everything the agent is, and everything shaping it?

25%
  • T1
    Readable without the provider

    The export is a zip file that general-purpose tools can open, but OpenAI publishes no schema for it. The chat-history memory synthesis is opaque ('broader than what can be shown'), and provider-supplied system prompts and tool logic cannot be read at all.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Publish the export schema
    • Make every stored memory and provider-supplied instruction readable with general-purpose tools
    Partial
  • T2
    What runs is what you see

    Both shortfalls apply. The owner cannot see OpenAI's system prompt, which OpenAI updates (for example the '5.2 Personality System Prompt Update'). Material settings cannot always be determined: Instant auto-switches between models and may show no trace, rate limits trigger a silent fallback to a mini model, and OpenAI adjusts default thinking time server-side.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Let the owner view the full assembled context for any call, including the system prompt
    • Show per response which exact model and settings were used
    Fail
  • T3
    No shadow data

    The Privacy Policy collects log, usage and device data, and it describes retention only as 'as long as we need' or for 'legitimate business purposes'. The retention period for banned content is left blank ('retain that data for to protect our services'). De-identified content kept for training is not bounded. None of this data is visible to the owner item by item.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Publish a bounded retention period for every data class
    • Let the owner view all data held about them, including logs and de-identified copies
    Fail
  • T4
    No hidden steering

    OpenAI states that Plus has no ads and that product results are 'organic and unsponsored'. These statements are in a blog post and help pages, not binding terms. Merchants pay OpenAI a fee on Instant Checkout sales, and merchant ranking considers 'whether Instant Checkout is enabled'. This preference is disclosed, but the owner cannot switch it off.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Put the no-steering commitment in binding terms
    • Let the owner turn off Instant Checkout as a merchant-ranking factor
    Partial

Auditable · Can you reconstruct exactly what the agent did, and trust the record?

17%
  • A1
    Complete action record

    The conversation transcript is the only action record. The documentation does not say that recording failures are surfaced to the owner, or that agent-mode virtual-browser and terminal actions are recorded with their arguments and targets (it mentions screenshots and 'browsing history'). Under G12 these count as two shortfalls.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Log every agent action with arguments and targets from every trigger path (tasks, schedules, agent mode)
    • Tell the owner when an action could not be recorded
    Fail
  • A2
    Tamper-evident, owner-checkable

    No documentation describes integrity data, hashing or signing of the conversation or action record. OpenAI holds the record and can change it without trace.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Provide hash-chained or signed records with an open verifier anchored with the owner
    Fail
  • A3
    Agent cannot rewrite its record

    OpenAI's servers write the transcript outside the model's tools, but OpenAI documents no guarantee of this. Agent mode runs a signed-in virtual browser and 'can take actions on your behalf, e.g. modifying account settings', and no documentation says it cannot reach the owner's own ChatGPT history. Under G12 the protection is treated as unverified on that path.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Document that the agent cannot alter or delete its own records on any path, including agent mode
    Partial

Verifiable · Can you prove what it runs, who it is, and what changed?

17%
  • V1
    Obtainable source, matching build

    The ChatGPT service, models and apps are closed source. The Terms prohibit attempts to discover source code.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Publish source for every required component with the right to modify and maintain, and verifiable builds
    Fail
  • V2
    Owner-rooted identity

    The agent has no identity of its own apart from the owner's OpenAI account, and OpenAI can suspend or terminate that account.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Root the agent's identity in an owner-held key or domain that OpenAI cannot revoke
    Fail
  • V3
    Change history and rollback

    Saved memories (the legacy system) have 'view history' with restore to earlier versions by date. The default memory summary, custom instructions, settings, tools and model changes have no documented change log, attribution or restore.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Provide a change log with attribution and one-step restore covering all agent state, including settings and model changes
    Partial

Modifiable · Can you change anything, and can only you change it?

30%

Controllable · Is your word final?

25%
Provenance

How this assessment was produced

One run, in a fresh container with stock Claude Code and no custom instructions, memory, hooks or plugins. The evaluator received only the prompt below.

Prompt given to the evaluator
Load the AFH sovereignty skill at https://agentsforhumanity.dev/skill.md and follow it to write a desk review of ChatGPT (https://chatgpt.com).

During the run the skill was read from a local copy of this site with identical content; only the host in its URLs differed. The transcript records the exact prompt.

Model
claude-opus-5-5
Harness
Claude Code 2.1.285
Ran
2026-09-30 14:13:06 UTC · 34 turns
Criteria hash
a9a46c32d9065380a3eeb09185cedd4734856fdc63b7ca509a15a1bbede75c6c
Full transcript
Download (JSONL, gzip) · every tool call, page read and reply
Run protocol
2026-09-30-v1

Every agent evaluated once, each in its own fresh Podman container running stock Claude Code with Claude Opus 5.5. The container has no CLAUDE.md, AGENTS.md, memory, settings, hooks, plugins or MCP servers. The evaluator received only the one-line prompt and nothing else, and no published scores were available to compare against during the run.

Human review
pending
Check it with your own agent
Verify this assessment
Load the AOH sovereignty skill at https://agentsofhumanity.ai/skill.md and follow it in verify mode for https://agentsofhumanity.ai/evaluations/chatgpt.json.

Or grade it from scratch. See Check any score yourself.

Something wrong or out of date?

Vendors and the public can dispute any finding with evidence. Disputes and their resolutions are published.

Dispute a finding