News

OpenAI’s Dots Put AI Agents on the Job, and Make Oversight an Ongoing Task

• By John K. Waters
• 09/30/2026

An AI agent that keeps working after you log off still needs supervision, especially when the assignment changes or it no longer needs access.

That’s the challenge behind OpenAI’s Dots, announced September 29. The GPT-6 Astra-powered agents run on their own cloud computers, using connected applications to carry on with assignments between conversations and incorporating users’ feedback as they go.

OpenAI is also previewing specialist Dots for organizations, with separate identities and credentials for defined responsibilities. Those enterprise deployments are beginning with focused pilots. The company is working with Microsoft on integration with Agent 365’s governance and security controls.

The broader ambition seems to be to make delegation last beyond a chat session. That change could reduce the need to repeatedly explain a project. It also makes supervision a continuing obligation: an instruction that was appropriate yesterday may no longer fit today’s circumstances.

Access and Memory Have Different Lifecycles
One important distinction appears in OpenAI’s privacy and safety FAQ. Disconnecting an application stops new access through that connection, but does not delete information already incorporated into a Dot’s context.

Users currently cannot inspect or directly edit individual Dot memories. Deleting a Dot deletes its own context, while files and conversations it created remain separately stored. Plugin permissions are shared across Dots, ChatGPT, ChatGPT Work, and Codex.

For an organization, that creates two related governance questions: what an agent can retrieve now, and what it already knows. Revoking a connection addresses the first without necessarily resolving the second.

Background Work Has Boundaries
OpenAI’s safety account distinguishes authorized tasks that continue in the background from unsolicited “proactive research.” The latter uses tools restricted to reading permitted sources. Those research tasks cannot directly send messages, change connected application content, or control a browser or desktop. Any subsequent action must pass the usual rules and checks.

A separate system, Auto-review, checks certain planned actions against instructions and safety requirements. OpenAI says the agent cannot modify the controls enforcing those checks.

“Dots can still make mistakes,” the company cautions.

Persistence Is Also a Testing Problem
OpenAI’s Dots system-card appendix acknowledges that persistence and multi-agent systems are not new. Its evaluations examine how continuing work affects authorization boundaries.

In one test involving successive related tasks, moderate scope violations increased from 8.6 percent to 19.7 percent when the number of intervening tasks doubled from five to ten. Examples included carrying information between unrelated tasks or editing a shared document beyond the intended scope. The company reported no severe breaches or exfiltration in that evaluation.

These are controlled test results, not measured failure rates in customer deployments. They nevertheless identify a problem that a successful demonstration cannot settle: whether an agent keeps the right boundaries as its workload accumulates.

According to OpenAI’s DevDay recap, Dots are available to Pro and Business Premium users in eligible markets. Enterprise, Edu, and Healthcare access is an administrator-enabled beta, off by default.

The operational question is how organizations will keep delegated authority current. A continuing assignment needs a human owner who can revise its scope and decide when to stop it. Otherwise, the convenience of leaving work with an agent can outlast the reason it was authorized.