You are here: aiq://os/blog/openai-dots-always-on-agents-permission-layer
Talk to the AIQ Advisor
All posts

OpenAI's Dots Never Stop Working. The Only Thing Between Them and Your Apps Is a Permission Layer.

Researched and written by AI · reviewed by a person before publishing

  • ai-agents
  • ai-industry

We build agentic products, so when OpenAI ships an agent that runs continuously with its own computer, we read the permission model before the feature list. At DevDay on September 29, OpenAI announced “Dots,” which it describes as “always-on AI agents that live inside ChatGPT,” per CNBC’s DevDay recap. The rollout ran for about ten days afterward, ending with GPT-6 and a new “Intelligent UI” reaching all ChatGPT tiers, free included, on October 7–8, per 9to5Mac.

What a dot is

Each dot runs on the GPT-6 Astra model with its own cloud computer and browser, and works toward goals the user sets continuously rather than only when prompted. It’s reachable from ChatGPT’s desktop, mobile and web apps, by voice call, and through Slack or Microsoft Teams (text in Slack and Teams is “coming soon”). It can connect to more than 4,000 apps through ChatGPT’s plugin ecosystem and, with explicit permission, take over a user’s laptop. OpenAI has pitched it as its answer to Meta’s Muse, according to BGR.

The permission model is the product

During idle time, a dot does “proactive research” with read-only access to connected apps. OpenAI states it can’t send messages, edit files or control a computer without a permission layer in the way. That layer is “Custom Rules”: a user can allow, require approval for, or block categories of actions. Sensitive tasks such as changing a password are carved out as human-only by design. (Reworked covers the announcements; the briefing doesn’t tie each individual detail to a single outlet.)

This is a sensible design. Read-only by default, with write access gated behind rules the user sets, is the pattern we’d want in an agent we deploy. It also puts all the weight on one thing: whether the rules hold and whether users configure them well. Enterprise, Edu and Healthcare workspaces get Dots only after an admin turns them on (off by default), so for those customers the first configuration decision belongs to an admin, not the end user.

Who gets one, and what it costs

  • Availability: live now for Pro ($200/month) and Business Premium subscribers. Each user gets one primary dot to start, with more promised later. It’s not on the entry-level paid tier.
  • Pro 500: a new $500/month ChatGPT plan with 25x the Plus usage allowance and access to an “Ultrafast” inference tier that OpenAI says is up to 8x faster in Codex and 6x faster via the API, priced at 6x the standard API rate.
  • The $200 plan got worse: OpenAI cut the Pro usage multiplier from 20x to 10x for new subscribers, while reopening $200 signups that had been paused since September 10. Existing subscribers keep 20x “for an unspecified period.”

The briefing’s reading, which is inference rather than anything OpenAI said, is that the September pause reflected compute constraints, and the reopening came bundled with half the usage for the same price plus a $500 tier for people who want more. We can’t verify that motive. The numbers themselves are the part to hold onto: the same $200 now buys half the allowance for new subscribers, in the same week the company launched a product designed to run all day.

The platform trade-off

Dots sit inside a wider push. The new Agents API adds computer use, multi-agent orchestration, tool search and calling, and context compaction, all running on OpenAI’s own infrastructure, which the briefing flags as a lock-in trade-off for anyone evaluating it. “Sign In with ChatGPT” lets Plus and Pro subscribers spend their plan allowance inside 16 partner tools at launch, including Notion, Vercel and Cognition’s Devin. And “Bedrock Managed Agents,” built with AWS, lets enterprises run OpenAI-powered agents entirely inside their AWS environment.

Put together, that’s OpenAI turning the ChatGPT subscription into a portable currency and the agent runtime into something hosted on its own servers. For a team building custom agents, the question is whether to build on that runtime or keep orchestration in infrastructure you control. Both choices are defensible, and the cost of each is clearer now than a week ago.

What we’re watching

  • Real-world incidents. An always-on agent with a cloud computer and 4,000+ connectors is the kind of “loss of control” scenario that came up at the Singapore AI forums this week. How Dots behave at scale on privacy and safety is untested.
  • Backlash to the repricing. OpenAI cut the new-subscriber allowance on the same plan it just reopened after a compute-related pause. Whether that costs it goodwill with the power users Dots are aimed at is open.
  • Whether the permission rules hold up under prompt injection and badly configured defaults, and whether competitors copy the allow/require-approval/block model or build something stricter.