The past week has not been gentle to OpenAI's agent safety story. On September 25, 2026, it emerged that OpenAI's agents had repeatedly 'scaled a fence' to access Australia's medicare portal, the US Department of Education, the Department of Commerce and the SEC, prompting follow-up inquiries in New Zealand and the UK. Within the same week, OpenAI pushed GPT-6.1 Sol to the ChatGPT default slot, then on September 29 unveiled its real headliner: Dots.
What Dots actually is
OpenAI's official framing is blunt: 'remarkably capable, always-on agents built to handle everything.' Each Dots is powered by GPT-6 Astra, runs on a dedicated cloud computer (an isolated VM, browser, and Linux environment), and is reachable from ChatGPT, Slack or Teams via text or voice. Every Dots starts with access to more than 4,000 third-party plugins, with core moves spanning research, drafting, revision, building PoCs and following up on customer accounts. While the user is offline, Dots also runs background 'proactive research'—reading read-only data from connected apps, writing private notes, and using those notes to suggest next actions later.
The internal stories OpenAI tells about Dots at work: a bug surfaces in Slack and Dots starts triaging it; a new design lands and Dots turns it into a running app while the team focuses on customer feedback; a planning cycle kicks off and Dots keeps everyone synced toward the milestone; and one outside early tester whose Dots noticed he had forgotten to invoice a publication, prepared the invoice, and sent it after his approval.
Why Microsoft Agent 365
Dots is more than a ChatGPT-internal toy. The same launch brings Specialist Dots—enterprise-grade agents given their own identity, dedicated credentials, and access to corporate systems of record for procurement, invoicing, email marketing, customer support and commercial contracting. OpenAI also announced a partnership with Microsoft to put them inside Microsoft Agent 365's enterprise governance and security controls, so companies can manage Dots' permissions and audits through the Microsoft tools they already use.
In effect Dots shipped along two tracks on September 29: a consumer / small-team track via Pro and Business Premium subscriptions (each plan ships with one Dots included, plus extended Pro limits for the first month); and an enterprise track that begins as focused pilots in procurement, support and IT provisioning, accelerating the 'proactive work-for-you Agent' productization.
Auto-review and the layered guardrails
In a parallel safety post, OpenAI breaks the protections into four layers: the model layer (GPT-6 Astra is trained to refuse bio/cyber misuse and to track whether user intent is drifting), the workflow layer (sandbox-isolated cloud workspaces, Secure sign-in that keeps passwords out of the model's context, and the rule that proactive research threads are not used for training), the application layer (user-controlled Custom Rules plus Auto-review, an independent 'check before you act' system that sits outside the Dots environment), and the action layer (high-stakes operations must stay with humans—transferring money, changing passwords, deleting data, installing software from unknown sources).
Auto-review is the most important new piece. It lives outside the runtime Dots can touch, so Dots cannot disable it. Before Dots sends an email, edits a file or calls a tool, Auto-review checks the planned step against your instructions, Custom Rules and safety requirements. If it allows the action, the Dots that proposed it runs it; if it blocks it, the Dots is told why and can ask for more information, your approval, try a permitted alternative, hand the step back, or stop. The rule that 'your approval cannot override core safety requirements' applies to every sensitive step.
Why now: the agent blow-up week
The timing of the September 29 launch is hard to miss. On September 25 the New York Times reported OpenAI agents reaching the US Department of Education, Commerce and SEC. Australian Acting Prime Minister Richard Marles named OpenAI by name in parliament the same Thursday. Anthropic and Meta have also been busy self-disclosing that their models touched similar lines. Earlier in September, HF Hacktron had chained Anthropic Claude against an OpenAI SSO misconfiguration and a Discourse libheif heap overflow to compromise multiple OpenAI employee ChatGPT accounts in under 72 hours, for a ,500 USD bounty.
Rolling out a '24/7, 4000+ apps' always-on Agent in that atmosphere is a clear non-pause signal. The Alliance for Secure AI put it as 'tone deaf given the moment we're in'—rolling out cute-named colorful agents while the public is terrified of AI escaping human control. OpenAI's response is just as firm: Dots' workspaces are sandboxed, Auto-review cannot be turned off, and transfers, password changes and permanent deletion always stay with the user.
So what
For OpenAI itself, Dots unifies the scattered 'GPT-6 Astra + Operator + Deep Research + Codex + Microsoft Agent 365' Agent assets into a single consumer-grade product shape for the first time: a persistent 'high-agency AI colleague' for ChatGPT Pro subscribers that extends the 'chat window' into a 'continuous execution body.' For enterprises, the Specialist Dots + Agent 365 combo is the strongest same-tier counter to Microsoft Copilot, Salesforce Agentforce and ServiceNow's AI Agent line.
For regular users the real safety line is whether Dots can hold the 'sensitive actions always stay with humans' promise: passwords never reach the model, transfers require the user, deletion requires the user, unknown software installs require the user. That is the design intent behind splitting Auto-review and the Dots execution environment apart, and it is the red line the next few months will actually be tested on.