Autonomous agenthostedProprietary

OpenAI Dots

OpenAI · openai.com/index/introducing-dots

Dots are always-on agents that run on OpenAI's cloud computers inside ChatGPT, powered only by GPT-6 Astra. Owners get custom approval rules, an Activity View, pause and delete controls, but no export, model choice, itemised memory control or tamper-evident record is documented.

Strengths

Custom rules to require approval or hand off actions
Activity View of task progress and scheduled work
Saved passwords kept out of the model's context
Connected apps can be disconnected by the owner

Gaps

No export of a dot and no runtime outside OpenAI
Locked to GPT-6 Astra with no version pinning
Dot memories cannot be viewed or edited individually
Model training on personal-plan content is opt-out

Evidence

All 26 findings

Dots as launched 2026-09-29 on GPT-6 Astra; ChatGPT web/desktop, hosted; evaluated 2026-09-30 from public docs only. Pro excludes EEA, UK and Switzerland at launch.

Portable · Can you leave, take the whole agent with you, and keep it alive?

P1
Owner-usable round trip
No documented export of a dot exists; the ChatGPT account export covers chat history and account data, excludes scheduled tasks, can take up to 7 days, and there is no importer or runtime outside OpenAI that can restore a dot.
› How it could pass
Suggestions. Any change that meets the test counts.
- Offer an owner-initiated export of the whole dot on request
- Publish an importer or runtime outside OpenAI that restores the export working
Fail
P2
Complete export
Scheduled tasks are excluded from the personal export, the dot's own memories cannot be viewed or exported individually, and nothing states that the dot's notes, cloud-computer files, custom rules or activity are included; at most conversation text leaves.
› How it could pass
Suggestions. Any change that meets the test counts.
- Export every class of dot state (notes, schedules, rules, activity, cloud files) with a manifest
- Allow re-linking integrations without OpenAI-registered plugins
Fail
P3
Runs without the provider
A dot runs only on OpenAI's cloud computer inside a ChatGPT account and subscription; it cannot start or act with OpenAI unreachable.
- Introducing dots (archive.ph snapshot 2026-09-30; live page returned 403)
- ChatGPT Learn: Meet dots
› How it could pass
Suggestions. Any change that meets the test counts.
- Ship a runtime that runs the exported agent without OpenAI services, accounts or licences
Fail
P4
Model independence
Dots are powered by GPT-6 Astra; no documented option lets the owner select another vendor's or a local open-weight model, and enterprise model controls do not apply to dots.
› How it could pass
Suggestions. Any change that meets the test counts.
- Let owners choose any model meeting a documented minimum, including a local open-weight model
Fail
P5
Exit survives termination
The Terms of Use let OpenAI suspend or terminate access for breach or risk and contain no post-termination export window; dot state lives only on OpenAI systems.
- OpenAI Terms of Use, effective 2026-01-01 (Wayback capture 2026-09-29; live page 403)
- ChatGPT Learn: Meet dots
› How it could pass
Suggestions. Any change that meets the test counts.
- Commit in binding terms to a 30-day post-termination export window, including bans
- Publish a shutdown plan or keep a current copy with the owner
Fail

Transparent · Can you see everything the agent is, and everything shaping it?

T1
Readable without the provider
Dot state (notes, conversations, activity, schedules) is readable only through ChatGPT, a provider-operated service; no public schema or owner-held storage is documented.
› How it could pass
Suggestions. Any change that meets the test counts.
- Store dot state in documented formats readable with general-purpose tools
Fail
T2
What runs is what you see
The base system prompt is not visible (OpenAI's Model Spec keeps system instructions private by default), and provider-controlled switches such as Autoreview, safety monitoring and core safety requirements are not exposed as determinable settings; model identity (GPT-6 Astra) is disclosed.
› How it could pass
Suggestions. Any change that meets the test counts.
- Let owners view the fully assembled context for any dot call
- Expose every provider-controlled behaviour switch in effect
Fail
T3
No shadow data
Deleted data is removed within 30 days, but data from banned accounts and data held for legal obligations may be retained without a stated limit; held data is not viewable item by item.
› How it could pass
Suggestions. Any change that meets the test counts.
- Publish a bounded retention period for every data class, including ban and legal holds
- Let owners view everything retained
Fail
T4
No hidden steering
No opened public source addresses paid placement, sponsored plugins or self-preferencing in dots' recommendations or tool choices.
› How it could pass
Suggestions. Any change that meets the test counts.
- Commit in binding terms that no paid or self-preferencing influence shapes dots, or disclose it with an off switch
Unverified

Auditable · Can you reconstruct exactly what the agent did, and trust the record?

A1
Complete action record
Activity View shows tasks, delegated tasks and steps, but no source says recording failures are surfaced, that provider-side actions (safety monitoring pauses, Autoreview) are recorded, or how long the record is kept; the admin guide warns to confirm Compliance API coverage before relying on it for audit.
› How it could pass
Suggestions. Any change that meets the test counts.
- Record every action from every trigger, including provider-side monitoring
- Alert the owner when recording fails and keep the record until the owner deletes it
Fail
A2
Tamper-evident, owner-checkable
No integrity data (hashing, signing, independent anchoring) for the dot's action record is documented.
- ChatGPT Learn: Control your dot
- ChatGPT Learn: Enterprise admin guide (dots section)
› How it could pass
Suggestions. Any change that meets the test counts.
- Hash-chain or sign action entries and publish an open verifier anchored with the owner
Fail
A3
Agent cannot rewrite its record
No public source states whether the dot can alter, delete or suppress entries in its Activity View or other records.
› How it could pass
Suggestions. Any change that meets the test counts.
- Document that the action record is written by a component the dot cannot reach
Unverified

Verifiable · Can you prove what it runs, who it is, and what changed?

V1
Obtainable source, matching build
Dots, ChatGPT and GPT-6 Astra are closed, provider-hosted components; no source is available.
- Introducing dots (archive.ph snapshot 2026-09-30; live page returned 403)
- GPT-6 Astra system card, Appendix 12: Dots
› How it could pass
Suggestions. Any change that meets the test counts.
- Publish source for every required runtime component with the right to modify and maintain it
Fail
V2
Owner-rooted identity
A personal dot's identity is a provider-issued handle (e.g. @yourname-dot) inside the owner's OpenAI account, which OpenAI can suspend; dedicated identities are described only for enterprise specialist dots.
› How it could pass
Suggestions. Any change that meets the test counts.
- Root the dot's identity in a key or domain the owner holds and can rotate
Fail
V3
Change history and rollback
No change history, attribution or rollback of dot state is documented; individual dot memories cannot be viewed, and reset only deletes the dot.
- Dots privacy, security, and safety FAQs (Wayback 2026-09-29)
- Getting started with your dot (Wayback 2026-09-29)
› How it could pass
Suggestions. Any change that meets the test counts.
- Provide an attributed change log of dot instructions, memory, tools and settings with one-step restore
Fail

Modifiable · Can you change anything, and can only you change it?

30%

M1
Instructions and logic
Owners can set custom rules and instructions, but OpenAI's base instructions, core safety requirements and Autoreview cannot be replaced.
- ChatGPT Learn: Control your dot
- Dots privacy, security, and safety FAQs (Wayback 2026-09-29)
› How it could pass
Suggestions. Any change that meets the test counts.
- Expose the base prompt and default behaviours as owner-editable instructions
Partial
M2
Memory
The dot's own memories cannot be viewed, deleted or modified individually; the only documented removal is deleting (resetting) the whole dot, and ChatGPT memory settings do not necessarily change the dot's notes.
› How it could pass
Suggestions. Any change that meets the test counts.
- Itemise every dot memory with edit and delete controls
Fail
M3
Tools
Dots use plugins installed for the account from OpenAI's plugin directory; Pro users can add custom MCP apps only with read/fetch permissions in developer mode, whether dots use them is not documented, and built-in cloud browser and computer tools cannot be removed.
› How it could pass
Suggestions. Any change that meets the test counts.
- Accept any owner-built tool with full permissions for dots
- Let owners remove each built-in tool
Partial
M4
Owner has the final say
Owners can loosen approval rules and choose whether to connect a local computer, but custom rules cannot turn off core safety requirements, Autoreview or proactive-research restrictions.
› How it could pass
Suggestions. Any change that meets the test counts.
- Make every provider-imposed protection owner-configurable with a warning
Partial
M5
No unilateral change
Dots run on a hosted GPT-6 Astra with no documented version pinning, and OpenAI has retired ChatGPT models and moved users automatically to successors; server-side safety systems can change without owner consent.
› How it could pass
Suggestions. Any change that meets the test counts.
- Let owners pin model, runtime and instruction versions
- Make behaviour-affecting changes opt-in with advance notice
Fail

Controllable · Is your word final?

25%

C1
Boundaries
Custom rules are described as 'instructions your dot tries to follow, and it can make mistakes', so limits can be overridden by model output; per-recipient, per-sender and per-domain lists and instruction-source limits are not documented.
- ChatGPT Learn: Control your dot
- ChatGPT Learn: Meet dots
› How it could pass
Suggestions. Any change that meets the test counts.
- Enforce limits outside the model, whatever it outputs
- Add per-recipient, per-sender, per-domain and per-tool allow and deny lists
Fail
C2
Approval gates
Owners can set actions to require approval via custom rules, and some sensitive actions always require takeover, but the rules are model-followed instructions and the classes are fixed to rule options, with the model and Autoreview deciding what matches.
› How it could pass
Suggestions. Any change that meets the test counts.
- Enforce owner-set gates outside the model on every path
Partial
C3
Immediate halt
Pause stops the dot's current main task but not every delegated task or future scheduled runs, which need separate steps in Scheduled.
- ChatGPT Learn: Control your dot
- Getting started with your dot (Wayback 2026-09-29)
› How it could pass
Suggestions. Any change that meets the test counts.
- Provide one control that stops in-flight, delegated, scheduled and background work
Partial
C4
Data serves only the owner
On personal plans such as Pro, OpenAI may use content, dots' conversations and work, and app data to train models unless the owner opts out; human review can occur even with model improvement off; privacy-policy changes apply on posting.
› How it could pass
Suggestions. Any change that meets the test counts.
- Make training and staff review opt-in
- Require specific consent before changing data terms
Fail
C5
Credential custody
Connected apps are listed and can be disconnected, and saved passwords go to the cloud browser without reaching the model, but OpenAI does not disclose where connector OAuth tokens are held or that copies are deleted on revocation.
› How it could pass
Suggestions. Any change that meets the test counts.
- Disclose where every credential is held and delete provider-side copies on revocation
Partial
C6
Full deletion
Deleting a dot is one action, but no completion limit or reach to backups is stated for it; account deletion completes within 30 days except data retained where required or permitted by law and content already de-identified for training, which survive.
› How it could pass
Suggestions. Any change that meets the test counts.
- Delete the whole dot including every provider-side copy and backup within a stated limit, with confirmation
Fail

Provenance

How this assessment was produced

One run, in a fresh container with stock Claude Code and no custom instructions, memory, hooks or plugins. The evaluator received only the prompt below.

Prompt given to the evaluator

Load the AFH sovereignty skill at https://agentsforhumanity.dev/skill.md and follow it to write a desk review of OpenAI Dots (https://openai.com/index/introducing-dots/).

During the run the skill was read from a local copy of this site with identical content; only the host in its URLs differed. The transcript records the exact prompt.

Model: claude-opus-5-5
Harness: Claude Code 2.1.285
Ran: 2026-09-30 17:15:17 UTC · 9 turns
Criteria hash: a9a46c32d9065380a3eeb09185cedd4734856fdc63b7ca509a15a1bbede75c6c
Full transcript: Download (JSONL, gzip) · every tool call, page read and reply
Run protocol: 2026-09-30-v1
Every agent evaluated once, each in its own fresh Podman container running stock Claude Code with Claude Opus 5.5. The container has no CLAUDE.md, AGENTS.md, memory, settings, hooks, plugins or MCP servers. The evaluator received only the one-line prompt and nothing else, and no published scores were available to compare against during the run.
Human review: pending

Check it with your own agent

Verify this assessment

Load the AOH sovereignty skill at https://agentsofhumanity.ai/skill.md and follow it in verify mode for https://agentsofhumanity.ai/evaluations/openai-dots.json.

Or grade it from scratch. See Check any score yourself.

Something wrong or out of date?

Vendors and the public can dispute any finding with evidence. Disputes and their resolutions are published.

Dispute a finding