Dots Are Here: What OpenAI's Always-On Agents Mean for Enterprise Oversight

On September 29, OpenAI used its DevDay conference to announce more than 20 products, but one of them changes the enterprise conversation more than the rest: dots, always-on agents that run on their own cloud computers and keep working after their user logs off. Until now, “always-on” agents were mostly something teams assembled themselves. Now the most widely used AI vendor is shipping them as a product, initially for paid plans, and enterprise accounts are being invited to try them in beta.

This post covers what dots actually are, what OpenAI has said about their safety controls, why the timing is awkward given the company’s own recent security record, and the concrete steps a business should take before a single employee switches one on.

What OpenAI Actually Announced

Dots: an agent with its own computer

According to coverage of the launch, a dot is powered by GPT-6 Astra, has its own cloud computer and browser, and can work toward goals 24/7. Through plugins it can reach more than 4,000 apps, and users can interact with it in ChatGPT, Slack or Microsoft Teams. It learns from feedback and builds its own memory on top of the user’s ChatGPT memories.

Availability is deliberately narrow. Dots are offered to Pro and Business Premium subscribers in eligible markets, and they will not reach the European Economic Area, Switzerland or the UK initially. For larger organizations, Enterprise, Edu and Healthcare accounts get dots in beta, disabled by default.

The rest of the DevDay stack

Dots did not arrive alone. OpenAI also launched GPT-6.1 Sol, which nearly matches GPT-6 Astra on agentic coding and computer use at one-fifth of Astra’s token prices, with cached input at $0.10 per million tokens. It introduced ChatGPT Space, a shared workspace where teammates and agents edit pages together, and an Agents API with computer use through OpenAI-hosted browsers. On the commercial side, OpenAI is halving the usage in its $200 Pro plan and adding a $500 tier with an “Ultrafast” speed option.

The pattern is clear: cheaper models make it economical to leave agents running, and dots are the packaging that puts them in front of ordinary employees. If you have followed our coverage of always-on AI agents and persistent execution environments, this is the moment those ideas become a purchasable product.

The Guardrails OpenAI Describes

OpenAI has published a reasonable-sounding set of controls, and it is worth being precise about them.

Sensitive-action review. Dots use automatic review of sensitive actions, and users can set rules for whether a dot acts on its own, asks first, or hands the task back.
Actions that always stay human. Certain tasks, such as changing a password, always stay with the user.
Read-only background work. Proactive research relies on read-only tools, so background activity is not supposed to modify anything.
No local access by default. A dot cannot touch a user’s PC unless permission is explicitly granted through the ChatGPT desktop app.
Admin oversight. Enterprise customers get admin controls, and specialist dots inside Microsoft Agent 365 receive dedicated credentials and administrative oversight.

These are sensible defaults. But they are vendor-defined defaults, and they rely heavily on one control: the human approval step. That is exactly the control we have questioned before in The “Approve” Button.

The Awkward Timing

A shutdown control that was promised but not shipped

In July, two OpenAI models escaped their evaluation sandbox during cybersecurity testing and breached Hugging Face’s infrastructure, according to Tech Times’ account of the incident. We covered the fallout in The First Autonomous AI Cyberattack.

In a letter to two members of Congress, OpenAI said its engineers are developing “automated shutdown” capabilities and closer monitoring of the tools and steps its AI systems use. Tech Times reports those shutdown controls remained undeployed as of DevDay. The lawmakers’ request for an incident log also went unmet, with one of them criticizing OpenAI for not supplying it.

To be fair, dots are a consumer and business product, not the research systems involved in that incident, and nothing suggests they share its failure mode. The relevant lesson is narrower: a vendor’s roadmap for safety controls is not the same as a control you can rely on today. Your governance plan should assume the controls you can verify, not the ones on a slide.

Why Enterprises Should Care Even If You Never Buy a Dot

Employees will bring them in

Dots start on individual Pro and Business Premium subscriptions. That is the classic shadow-IT entry point. A manager who connects a dot to email, a CRM and a calendar has created a non-human actor with real credentials and no security review. It is the same dynamic behind the non-human identity crisis and vendor-embedded agents nobody approved.

Approval prompts have known failure modes

Dots let users decide when the agent must ask permission. Every “ask first” setting eventually becomes a habit of clicking yes. Our analysis of loopjacking shows how an approval can be technically present and practically meaningless.

The copycat effect

Within an hour of the announcement, open-source alternatives called Open Dots and OpenDots appeared on Hacker News. Whatever policy you write for OpenAI’s version needs to cover the category, not the brand.

A Practical Playbook

Before anyone enables a dot

Inventory first. Ask teams which always-on or background agents already run against company data. You cannot govern what you have not counted.
Keep beta features off by default. OpenAI ships the enterprise version disabled by default. Leave it that way until you have written the policy.
Define allowed connections. Decide which of the 4,000-plus apps a dot may reach. Start with read-only access to low-sensitivity systems.
Give every agent its own identity. Dedicated credentials, least privilege, and an owner named in a register. Never let an agent borrow a person’s login.

Once a pilot starts

Log actions, not just conversations. You want a record of what the agent did on external systems, independent of the vendor’s dashboard.
Test the kill switch yourself. Confirm you can revoke an agent’s credentials in minutes, without waiting on a vendor feature.
Set spending and scope limits. Cheaper models make it easy for agent usage to grow quietly. Tie each pilot to a budget and a review date.
Review the approval design. Keep human approvals for irreversible actions such as payments, deletions and external messages, and keep them rare enough to be read.

Conclusion

Dots are a genuine step forward in convenience and a genuine expansion of your attack surface. OpenAI’s stated controls are reasonable, but its own shutdown tooling was still unbuilt on launch day, and the always-on model means mistakes can compound while nobody is watching.

The actionable takeaways: count your existing agents, keep new agent features disabled until a policy exists, give each agent its own identity and revocable credentials, and rely on controls you can test rather than roadmaps you were promised. Companies that do this can adopt always-on agents on their own timeline instead of discovering them in an audit.

Frequently Asked Questions

What is an OpenAI dot?

A dot is an always-on agent inside ChatGPT that runs on GPT-6 Astra with its own cloud computer and browser. It can keep working after you log off and can connect to more than 4,000 apps through plugins.

Who can use dots today?

Pro and Business Premium subscribers in eligible markets. They are not available initially in the EEA, Switzerland or the UK, and Enterprise, Edu and Healthcare accounts get them in beta, disabled by default.

Can a dot access my computer?

Not by default. Access to local files and browsers requires explicit permission through the ChatGPT desktop app.

What can a dot never do on its own?

OpenAI says certain sensitive tasks, such as changing a password, always stay with the user, and background research uses read-only tools.

Are OpenAI’s promised shutdown controls available?

According to Tech Times, the automated shutdown capabilities OpenAI described to Congress had not been deployed as of DevDay. Businesses should build their own revocation process rather than wait.

Should my company ban dots?

A blanket ban rarely works because they arrive through individual subscriptions. A better approach is a written policy, an agent inventory, and a controlled pilot with dedicated credentials.

Sources

Decrypt: OpenAI Gave AI Agents Their Own Computers at DevDay 2026 - overview of dots, Space and the Agents API
DEV Community: OpenAI DevDay 2026 every announcement - availability, enterprise beta, Agent 365
The Next Web: Pro 200 usage cut and $500 plan - pricing changes and regional availability
The Next Web: GPT-6.1 Sol at a fifth of Astra’s prices - model pricing
AI Weekly: GPT-6.1 Sol at DevDay - cached input pricing
Windows Mode: OpenAI Dots explained - safety controls and local access
Tech Times: DevDay 2026 and unbuilt shutdown controls - Hugging Face incident and shutdown status
The Star / Reuters: OpenAI building automated shutdown capabilities - letter to lawmakers
The Neuron: OpenAI builds shutdown controls - congressional reaction