OpenAI used its September 29 DevDay presentation to show a persistent agent inside ChatGPT that keeps working after the user stops chatting, according to a community write-up on dev.to dated as a snapshot of October 17, 2026. The author states plainly that he has not operated one: OpenAI's announcement page returned a 403 error while he was gathering material, so his account rests on third-party write-ups that cite OpenAI's announcement and help center. He says the key numbers matched across three or four sources and flags where only one exists.
The described architecture is a coordinator rather than a worker. A dot is said not to write code itself but to hand coding to Codex and heavier office work to ChatGPT Work, with those tasks surfacing as separate threads the user can steer. Each dot reportedly gets its own cloud machine with a browser, access to more than 4,000 services through plugins, and a separate memory store that learns from corrections. The underlying model is identified as GPT-6 Astra, released September 3.
Two execution paths are described. The cloud computer appears under a Computers view, where the user can take over the browser and hand control back; sign-in credentials are routed to the remote browser without the model seeing them, and reusing a saved password requires confirmation. Because some sites block cloud browsers, a dot can alternatively drive the user's own laptop through the ChatGPT desktop app, limited to one personal computer at a time that must be online with the app open.
The permission system is presented as the substance of the product. Under custom rules, each action falls into one of four modes: act without asking where mistakes are cheap, act on command once pre-approved, prepare a draft and wait for a yes, or hand the task back at the point a human is needed. On top of user rules sit limits the write-up says cannot be removed: password changes and money transfers always return to the user, purchases need approval with advance approval valid only for a specific purchase, and an auto-review layer can block, ask about or stop actions touching accounts or sharing information, such as sending email.
The most consequential figures come from an appendix to the GPT-6 Astra system card, which the author says he found in full in only one source, a deep dive by Flavio Copes. Prompt injection testing is reported as 100 runs over 500 simulated emails and 16,600 attacks with no successes, and an adaptive attacker making 2,638 attempts with none succeeding. Human red-teamers' data exfiltration attempts all failed. The author singles out a different line: scope violations in chained tasks ran at 8.6% with five intervening tasks and 19.7% with ten, with no severe breaches reported.
That last figure matters because of how dots are meant to be used. The author's reading is that a near one-in-five drift rate on ten-task chains is not an attack but an agent losing track of its brief, and that long chains unfolding over weeks are precisely the intended mode of operation. He quotes OpenAI's own caveat that dots can still make mistakes and consequential work should always be reviewed. For freelancers weighing delegation, the practical translation is that the failure mode to plan around is quiet scope creep, not a dramatic breach.
The write-up treats memory as a second genuine gap rather than a tradeoff. Conversation content, relevant ChatGPT memory and the dot's own notes all feed a dot, yet those notes offer no per-entry viewing, correction or deletion; wiping the dot entirely is the sole full reset. What was already learned survives disconnecting a plugin, which merely halts new access; switching off ChatGPT memory halts sharing but leaves what the dot already received in place. Credentials, images and screenshots are said not to enter dot context. For an agent reading mail over months, the write-up describes the absence of a forget-this control as a real limitation.
Several documented boundaries constrain what a dot can be trusted with. The unprompted work the product advertises is read-only, proactive research: messages cannot be sent, app content cannot be altered, a browser cannot be driven. Delegated or scheduled work may continue even when pausing halts the main task, and with nothing rolled back a sent email stays sent. Dots are given no email address of their own, the user cannot be called by them, and texting remains a narrow beta for some US Pro users. The current limit is one primary dot per person, with teams of dots planned.
Only partial details are given on cost and availability. Included is the first dot, and for the first month after launch extended limits apply, yet no published prices exist for post-launch limits, additional dots or extra capacity. Desktop-only is the setup, and anyone under 18 cannot use dots. The author also notes that talking to a dot does not count toward ChatGPT usage limits, while Codex and Work tasks it starts do.
For developers, the absence of an API is framed as a strategic signal rather than an oversight. There is no announced way to talk to a dot from code; it is a ChatGPT product, not a developer platform. The author reads the Codex integration as evidence of a hierarchy being built, with a general agent that knows the user's work on top and specialized executors below. His editorial conclusion is that selling a generalist assistant becomes harder while a narrow executor with a clear interface remains in demand, which is analysis rather than a measured finding.
The write-up offers task shapes rather than benchmarks. Good candidates are recurring, span several apps and end in a draft: matching delivered projects to invoices every Friday and sending nothing, watching a leads label and drafting replies that require approval, comparing stock against reorder levels and drafting purchase orders without placing them. Bad candidates are irreversible: money, passwords, unchecked email to important people. The author's advice is to start with drafts and widen permissions one at a time, treating the dot like a new assistant.
The comparison to competing products is explicitly described as based on product descriptions rather than measurements, and the piece does not supply those descriptions in the extracted text, so no competitive ranking can be drawn from it. Likewise, the launch anecdote about a tester's dot assembling a forgotten invoice from an email thread and sending it as a PDF only after approval illustrates the approval gate; it is a single reported example, not evidence of reliability.
What remains unknown is substantial. The author has not operated a dot, the vendor's own pages were inaccessible to him, and the rollout is described as gradual with details expected to change. Pricing beyond the first included dot is unpublished. The system-card figures rest on a single secondary source in his account. The scope-violation rates describe simulated chained tasks, not production freelancer workflows, and should not be generalized to all agent-assisted work.
The useful takeaway for independent designers and developers is narrower than the launch framing suggests. The permission ladder and the draft-first pattern are the parts that map onto freelance risk tolerance, because they keep irreversible actions behind a human. The parts that do not yet map are auditability of what the agent has learned and any programmatic integration. Until memory can be inspected and an API exists, a dot is something to pilot on reversible, recurring work with a review step, not a system to wire into client-facing operations.