Dots · always-on agents
Agents that keep working between conversations — each with its own cloud computer, browser and time budget.
Agents that live inside ChatGPT and keep working when you are not talking to them. A normal chatbot answers and stops. A dot holds a goal, works in the background on its own cloud computer and browser, and comes back when it has something for you to approve.
What you build with it
- Standing jobs — “watch for this and draft a reply”
- Multi-hour research that does not fit inside one conversation
- Routine admin that spans several different apps
- Monitoring that should act on what it finds, not just alert you
What it gets you
- Work happens between conversations, not only during them
- Reaches more than 4,000 apps
- Brings finished work back for approval instead of acting blind
- A time budget bounds both the bill and the blast radius
- Engine
- GPT-6 Astra
- Each dot gets
- Cloud computer + browser
- Integrations
- 4,000+ apps
- Reachable in
- ChatGPT · Slack · Teams · voice
- Access
- Pro · Business Premium · Enterprise beta
Straight from the source
Watch instead of reading
The fast version, if you do not have time for the whole write-up.
Why it matters
Every agent framework so far has been request-shaped: you ask, it loops, it returns, it dies. A dot is process-shaped — it keeps a goal, works in the background, and comes back when it has something. That is a different engineering problem, and the primitives OpenAI chose to solve it are worth studying even if you never use the product.
From a request to a process
ChatGPT and Codex respond to prompts. A dot pursues a goal continuously with minimal oversight, forming memories from connected apps without a new message from you.
The example from early testers is the clearest illustration: a dot noticed its user had forgotten to invoice a publication, prepared the invoice, and sent it once he approved. Nobody asked it that morning. It was holding a standing goal and acted when the world changed.
If you build agents, the shift is from "run until the task is done" to "run until the budget is spent, then report". Those need different state handling, different observability and a different cost model.
The time budget is the primitive worth stealing
OpenAI's system card describes a time-budget setting that guides how long a dot works. That sounds mundane and is actually the whole safety and cost story of an always-on agent.
An agent loop without a bound is an unbounded bill and an unbounded blast radius. A step limit is the usual answer but it is a poor proxy — one step can be a web crawl. Budgeting wall-clock time bounds both spend and exposure in the unit you actually care about.
The same goes for the review step. A dot brings finished work back for approval rather than shipping it, and permissions run through Custom Rules with safety checks that cannot be switched off.
Read the threat model before copying the pattern
OpenAI classifies GPT-6 Astra as reaching the Critical threshold in cybersecurity under its Preparedness Framework. That is the vendor saying, in its own words, that this is a serious capability.
Pair that with the surface: a persistent agent, its own computer, its own browser, more than four thousand app integrations, and optional access to the user's laptop. Everything it reads from a page, an inbox or a connected app is untrusted input that may be trying to redirect it.
If you build the same shape, the boundary rules matter more than the agent loop. Instructions come from your user; everything the agent retrieves is data. Side-effectful actions get an approval gate, and the agent runs with the user's permissions, not a superset.
Reach for it when
- The work is long-running and does not fit inside a single request/response
- You can state the goal plus the approval gates, not just a prompt
- You want finished work brought back for review rather than a live chat
Watch out for
- Unbounded autonomy needs an explicit budget — time, not just steps
- A browser plus a computer plus 4,000 integrations is a large prompt-injection surface
- Access is gated to Pro and Business Premium, with Enterprise in beta