Skip to content
Agents of Humanity
About
Public preview. Results are preliminary (criteria v1.0, 30 Sept 2026). Tell us what we got wrong
Autonomous agenthybridProprietary

ChatGPT Atlas

OpenAI · chatgpt.com/atlas

ChatGPT Atlas is a closed-source Chromium-based macOS browser with ChatGPT, browser memories and an agent mode built in. The agent's memory, chats and instructions are held on OpenAI's servers. It runs only on OpenAI's models and account. The product was deprecated and scheduled to stop working on 9 August 2026, with a documented export path for bookmarks only.

Portable0
Transparent13
Auditable17
Verifiable0
Modifiable40
Controllable25
Strengths
  • Browser memories can be viewed and archived, and per-site page visibility can block ChatGPT from reading a site
  • Owner-editable custom instructions for agent mode and ChatGPT
  • Training on browsed web content is off by default
  • One-step self-service account deletion with a stated 30-day limit
Gaps
  • No agent export or restore outside OpenAI; the product shutdown ended access with about 30 days' notice
  • Closed source, locked to OpenAI models and accounts, identity is an OpenAI account
  • No tamper-evident or per-action audit record
  • Chat content used for training by default and diagnostic logs on by default
Evidence

All 26 findings

Last documented build 1.2026.63.7 (10 March 2026 release notes), macOS on Apple silicon, desk review dated 2026-09-30. OpenAI's help centre says Atlas is deprecated and was 'scheduled to stop working on August 9, 2026'. The chatgpt.com/atlas snapshot from 2026-09-17 shows the ChatGPT home page with no download. No current release is obtainable, so this grades the last shipped release and its documented terms. Atlas's agent mode is the in-browser ChatGPT agent. US consumer Terms of Use and Privacy Policy apply. All OpenAI pages returned HTTP 403 to automated fetches, so every source is a Wayback Machine snapshot.

Portable · Can you leave, take the whole agent with you, and keep it alive?

0%
  • P1
    Owner-usable round trip

    The only self-service export is the ChatGPT account export ('can take up to 7 days to arrive', ZIP of chat history and account data) plus Atlas bookmark HTML export. No importer or non-OpenAI runtime restores the agent from it.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Offer an on-demand agent export with a matching import into a runtime OpenAI does not operate
    Fail
  • P2
    Complete export

    OpenAI says browser history and open tabs will not transfer and gives cookie export only 'where available'. The documented export covers chats and 'other relevant account data'. It does not document inclusion of browser memories, agent-mode custom instructions, schedules or provider-supplied logic, so two or more classes of state stay with the provider.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Publish a manifest of every class of agent state and include all of it in the export
    • Export browser memories with their source and agent instructions and schedules
    Fail
  • P3
    Runs without the provider

    Atlas requires signing in to a ChatGPT account, and its assistant and agent run on OpenAI's service. OpenAI states Atlas 'may no longer open, browse, or support browser-based agentic workflows' after the provider-set shutdown date.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Grant a perpetual right to run the agent without an OpenAI account or service
    • Let the owner point every service endpoint at alternatives
    Fail
  • P4
    Model independence

    The sidebar has a model picker (release notes, 28 Oct 2025), but no documentation describes using a non-OpenAI or local model. The agent is locked to OpenAI's models.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Support owner-chosen models, including a local open-weight model, with a documented minimum contract
    Fail
  • P5
    Exit survives termination

    OpenAI discontinued Atlas with an 'approx. 30 day wind down period' covering only bookmark export and manual saving of pages. Browser history and tabs would not transfer and Atlas stops working afterwards. The Terms of Use allow suspension or termination for breach or risk and commit to no post-termination export window.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Keep a complete current copy of agent state in the owner's hands
    • Commit in binding terms to a 30+ day export window covering bans and shutdown
    Fail

Transparent · Can you see everything the agent is, and everything shaping it?

13%
  • T1
    Readable without the provider

    Memories, chats, agent history and agent instructions are held on OpenAI's servers and read through ChatGPT. Browser memory summaries are generated server-side. Provider-supplied instructions and agent logic are not published, and no schema is documented for the export.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Store agent state in documented formats readable without OpenAI services
    • Publish provider-supplied instructions and logic in readable form
    Fail
  • T2
    What runs is what you see

    No documentation lets the owner view the base system prompt or the assembled context for the sidebar or agent. The model used by agent mode, the server-side safeguards (prompt-injection monitoring, site blocklist) and provider flags are not exposed as settings the owner can determine.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Let the owner view the fully assembled context of any call
    • Expose model identity and every provider-controlled switch in effect
    Fail
  • T3
    No shadow data

    Browser-memory summaries are kept up to 7 days and are not itemised. 'Help improve browsing & search' diagnostic logs are on by default with no retention period stated. The Privacy Policy keeps data of banned accounts and data under legal or security holds without a bounded period, and keeps de-identified content used for training.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Publish a retention table with bounded periods for every data class
    • Let the owner view diagnostic logs and other retained data item by item
    Fail
  • T4
    No hidden steering

    First-party ChatGPT search is the default and the owner can set Google as the default search engine. OpenAI shows ads to Free and Go users, not to the graded Plus tier, and shares information with search and shopping partners. No binding commitment rules out paid or self-preferencing influence on the agent.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Put a no-paid-placement, no-self-preferencing commitment for agent context and recommendations in binding terms
    Partial

Auditable · Can you reconstruct exactly what the agent did, and trust the record?

17%
  • A1
    Complete action record

    The agent's work is visible only as chat history and screenshots, which the owner can delete. OpenAI documents no per-action record with arguments and targets and no notice when recording fails. For the one tier where documentation exists (Enterprise), it states that Atlas emits no Compliance API or audit logs and that individual agent actions are not logged.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Keep a durable log of every agent action with targets and data, across scheduled and interactive runs
    • Tell the owner when an action cannot be recorded
    Fail
  • A2
    Tamper-evident, owner-checkable

    No integrity data, signing or verifier for any agent record is documented.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Hash-chain or sign the action record with an open verifier anchored with the owner
    Fail
  • A3
    Agent cannot rewrite its record

    Chat history is stored server-side and is not among the agent's documented tools. The agent cannot run code or reach the file system. However, the logged-in agent operates the owner's browser session, and nothing documented stops it from reaching chatgpt.com history controls. The protection rests on convention, not a documented guarantee.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Document and enforce that the agent cannot delete or alter its own record on any path
    Partial

Verifiable · Can you prove what it runs, who it is, and what changed?

0%
  • V1
    Obtainable source, matching build

    Atlas is a closed-source proprietary browser. OpenAI publishes only an LGPL source bundle per build, and the ChatGPT service the agent needs is closed.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Release source for every required component under terms allowing modification and third-party maintenance
    • Make builds verifiable against that source
    Fail
  • V2
    Owner-rooted identity

    The agent's identity is the owner's ChatGPT account, which OpenAI can suspend or terminate under its Terms of Use.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Root agent identity in an owner-held key or domain that OpenAI cannot revoke
    Fail
  • V3
    Change history and rollback

    No change history, attribution or rollback is documented for memories, custom instructions, settings or model changes. The owner can only view current state.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Keep an attributed change log of agent state with one-step restore
    Fail

Modifiable · Can you change anything, and can only you change it?

40%
  • M1
    Instructions and logic

    Owners can set custom instructions for agent mode (preferred sources, required steps, approval checkpoints) and ChatGPT custom instructions. OpenAI's base system prompt and built-in agent behaviour cannot be replaced.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Expose the base prompt and default agent logic as owner-editable instructions
    Partial
  • M2
    Memory

    Browser memories can be viewed and archived in Settings > Personalization but not edited. They are deleted only by deleting the related browsing history. ChatGPT saved memories are managed separately.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Make every browser memory item directly editable and deletable
    Partial
  • M3
    Tools

    Atlas supports browser extensions and the agent can use ChatGPT apps from OpenAI's catalogue. The agent's own tool set (navigate, click, type) is fixed, it cannot install extensions, and no way to add owner-built agent tools or remove built-ins is documented in the sources reviewed.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Accept owner-built agent tools without review
    • Let the owner remove any built-in agent tool
    Partial
  • M4
    Owner has the final say

    Some protections are owner-adjustable: safe search for result links, page visibility, logged-in or logged-out agent mode, and the browser-memory sensitive-data filter's effect via memories off. Watch mode on sensitive sites, the agent website blocklist and the restrictions on code and downloads are locked.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Let the owner change or disable every provider-imposed agent protection, with a warning
    Partial
  • M5
    No unilateral change

    Automatic updates are on and recommended. Agent behaviour changed server-side (e.g. reduced 'laziness', Feb 2026). The Terms let non-adverse changes take effect on posting. OpenAI then discontinued the product outright. The owner cannot pin the model or instructions.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Let the owner pin runtime, model and instruction versions
    • Make behaviour-affecting changes opt-in with a changelog shown first
    Fail

Controllable · Is your word final?

25%
  • C1
    Boundaries

    Owners can limit data scope per site (page visibility), choose logged-out agent mode and set site permissions. No owner limit on whose instructions the agent follows (prompt injection is handled only by provider safeguards) or whom it contacts is documented. On the graded Plus plan, website blocking is available only to workspace owners on request.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Add owner-set instruction-source and contact allow/deny lists that hold against model output
    • Offer self-service per-domain agent allow and deny lists
    Fail
  • C2
    Approval gates

    The agent asks for confirmation on high-impact actions the model identifies. Owners can write 'approval checkpoints' only as custom instructions, so the model decides what is gated.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Let the owner gate any action class with an enforced, non-model check
    Partial
  • C3
    Immediate halt

    The owner can pause, interrupt or take over the agent in the foreground. Recurring agent tasks are managed separately at chatgpt.com/schedules, and no single global stop is documented.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Provide one control that stops in-flight, scheduled and server-side agent work
    Partial
  • C4
    Data serves only the owner

    For consumer plans, content is used to train models unless the owner opts out, and Atlas chats follow that setting. Browsed-content training is off by default. Diagnostic logs are on by default. Staff may access agent content for abuse, support, legal and model improvement. Privacy Policy changes take effect on posting.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Make training and staff review opt-in
    • Turn diagnostic logging off by default
    • Require specific consent for data-term changes
    Fail
  • C5
    Credential custody

    Saved passwords, passkeys, per-site cookies and site data can be viewed and deleted locally, and logged-in agent mode uses the owner's existing sessions. OpenAI does not state where session data used by the agent is held, that it is used only for owner-directed actions, or that no copy remains after revocation.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • List every credential and session grant the agent can use, with per-item revoke
    • Commit to provider use only for owner-directed actions and deletion on revocation
    Partial
  • C6
    Full deletion

    Account deletion is one action with a 30-day limit. OpenAI may retain a limited set of data longer where required or permitted by law, retains data from banned accounts, and does not remove de-identified content already used for training. Atlas browser data is deleted separately, and completion is not documented as confirmed.

    › How it could pass

    Suggestions. Any change that meets the test counts.

    • Make one deletion reach every provider-side copy and Atlas data within a stated limit
    • Confirm completion to the owner
    Fail
Provenance

How this assessment was produced

One run, in a fresh container with stock Claude Code and no custom instructions, memory, hooks or plugins. The evaluator received only the prompt below.

Prompt given to the evaluator
Load the AFH sovereignty skill at https://agentsforhumanity.dev/skill.md and follow it to write a desk review of ChatGPT Atlas (https://chatgpt.com/atlas).

During the run the skill was read from a local copy of this site with identical content; only the host in its URLs differed. The transcript records the exact prompt.

Model
claude-opus-5-5
Harness
Claude Code 2.1.285
Ran
2026-09-30 14:10:22 UTC · 29 turns
Criteria hash
a9a46c32d9065380a3eeb09185cedd4734856fdc63b7ca509a15a1bbede75c6c
Full transcript
Download (JSONL, gzip) · every tool call, page read and reply
Run protocol
2026-09-30-v1

Every agent evaluated once, each in its own fresh Podman container running stock Claude Code with Claude Opus 5.5. The container has no CLAUDE.md, AGENTS.md, memory, settings, hooks, plugins or MCP servers. The evaluator received only the one-line prompt and nothing else, and no published scores were available to compare against during the run.

Human review
pending
Check it with your own agent
Verify this assessment
Load the AOH sovereignty skill at https://agentsofhumanity.ai/skill.md and follow it in verify mode for https://agentsofhumanity.ai/evaluations/chatgpt-atlas.json.

Or grade it from scratch. See Check any score yourself.

Something wrong or out of date?

Vendors and the public can dispute any finding with evidence. Disputes and their resolutions are published.

Dispute a finding