Issue #1 · Oct 15, 2026
OpenAI dots
77/100
Always-on ChatGPT agent · OpenAI · ChatGPT Pro, Business Premium, Enterprise · https://learn.chatgpt.com/docs/dots
| Category | Grade | Points | Why |
|---|---|---|---|
| Privacy | C (3/5) | 15/25 | Personal plans train by default (opt-out exists). You can't delete single memories. |
| Security | B (4/5) | 20/25 | Model never sees passwords, plus Auto-review and a bug bounty. SOC 2 covers business plans. |
| Transparency | A (5/5) | 20/20 | Named model, a system card with failure rates, docs that admit limits. |
| Pricing Honesty | C (3/5) | 9/15 | Pro-only. Tier prices and the "deeper work" allowance aren't spelled out. |
| Agent Safety | B (4/5) | 8/10 | Money transfers and password changes go back to you. Pause doesn't stop everything. |
| Scam Signals | A (5/5) | 5/5 | OpenAI, on official OpenAI domains. |
| Total | C | 77/100 | Verdict: SKETCHY |
Quick verdict: dots are the best-documented agents this week, and they still get a C, because "always on, inside your inbox" sets a high bar. On personal plans, your dot's conversations, actions, and connected-app data can be used for training unless you switch it off [27] [29]. And you can't view or delete individual memories. It's the whole dot or nothing [27].
What it does: A dot is an always-on agent with its own cloud computer and browser. It's powered by GPT-6 Astra and keeps working while your devices are off [24]. You reach it in ChatGPT, Slack, Teams, or by phone call. It uses your ChatGPT plugins (Gmail, Drive, GitHub) and can optionally connect to one personal computer [24]. Access is limited to Pro 100/200/500 (18+, outside the EEA, UK, and Switzerland), Business Premium, and Enterprise, where it's off by default [24].
🚩 Red flags
- Training by default on personal plans. For Free, Plus, and Pro, "data sharing is enabled for you by default" [29]. For dots, that "may include actions dots take, work they delegate to other agents, automations you set up, and data from connected apps" [27].
- Humans may look anyway. Human review "may occur in limited circumstances... even when model improvement is turned off" [27].
- No memory scalpel. "You currently cannot view, delete or directly modify individual dot memories." Disconnecting a plugin doesn't delete what the dot already absorbed [27].
- Boundaries slip on long jobs. In OpenAI's own system card, boundary-problem flags rose from 8.6% to 19.7% when chained tasks doubled from five to ten. An outside red team (Gray Swan) estimated an 8.5% attack success rate [31].
- Your rules are suggestions to it. Custom rules are "instructions your dot tries to follow, and it can make mistakes" [25].
- Pause isn't a kill switch. It stops the main task only. Delegated tasks and schedules keep going, and "stopping work doesn't undo completed actions" [25].
- Attestations don't cover Pro. SOC 2 and ISO 27001 are listed for business products [32]. The pricing table marks SOC 2 Type 2 as "No" for Pro [30].
✅ Green flags
- The most sensitive actions, like "changing a password or transferring money," require you to take over [27].
- Purchases with saved cards require your approval [27].
- Sign-ins use a private form, and credentials aren't exposed to the model [27] [24].
- Auto-review checks recipients and content before an email goes out [27].
- There's an Activity view, Pause, a Scheduled list, and custom rules that include "Hand off to you" [25].
- Proactive background research is read-only and can't send or change anything [26].
- No training by default on Business and Enterprise [28]. MFA, a bug bounty, and AES-256 at rest [27] [30].
How to use it safely
- Before you create a dot, turn off Improve the model for everyone [28].
- Add custom rules: Ask before taking action for anything that sends, Hand off to you for deletes and purchases [25].
- Don't connect your computer unless the job needs it [24].
- Give your dot its own Slack account so it has its own identity there [27].
- Turn on MFA for ChatGPT [27].
- After a sensitive project, delete the dot. That's the only way to wipe its context [27].
- Check Activity and Scheduled weekly. Pause won't catch everything [25].
Graded from public documentation as fetched Oct 15, 2026. No hands-on account tests. Numbered citations refer to the Issue #1 source list. Vendors: send corrections with a source and we'll publish them.