OpenAI Operator Research Preview

OpenAI has released Operator, a research preview of an AI agent capable of using its own web browser to execute tasks independently. By interacting with graphical user interfaces (GUIs) through typing, clicking, and scrolling, Operator shifts AI from a passive tool to an active participant capable of handling repetitive browser-based workflows.

Integration and Availability

As of July 17, 2025, Operator is fully integrated into ChatGPT as "agent mode," accessible via the composer dropdown. This integration replaces the standalone site (operator.chatgpt.com), which is scheduled to sunset. The tool was initially launched as a research preview for Pro users in the U.S.

Technical Architecture: The Computer-Using Agent (CUA)

Operator is powered by a new model called the Computer-Using Agent (CUA). This model combines the vision capabilities of GPT-4o with advanced reasoning developed through reinforcement learning to interact with GUIs, including buttons, menus, and text fields.

Key technical characteristics include:

  • Visual Interaction: CUA "sees" the browser via screenshots and interacts using standard mouse and keyboard actions, removing the need for custom API integrations.
  • Self-Correction: The agent uses reasoning capabilities to self-correct when it encounters mistakes or challenges.
  • Performance: CUA has established new state-of-the-art benchmark results in WebArena and WebVoyager, two primary browser-use benchmarks.

Capabilities and User Workflow

Operator can execute a wide variety of tasks, such as ordering groceries, filling out forms, and creating memes. It supports several advanced workflow features:

  • User Takeover: Users can take control of the remote browser at any time. Operator is specifically trained to hand over control for CAPTCHAs, payment details, or login requirements.
  • Personalization: Users can apply custom instructions for all sites or specific domains (e.g., setting airline preferences on Booking.com).
  • Prompt Saving: Repeated tasks, such as restocking groceries on Instacart, can be saved as prompts on the homepage for quick access.
  • Parallel Execution: Users can run multiple tasks simultaneously by creating separate conversations.

Ecosystem Partnerships and Public Sector Use

OpenAI is collaborating with several companies to refine Operator's real-world utility and conversion rates, including Uber, DoorDash, Instacart, OpenTable, Priceline, StubHub, and Thumbtack.

Beyond commercial use, OpenAI is working with the City of Stockton to improve civic engagement and make it easier for residents to enroll in city services and programs. Jamil Niazi, Director of Information Technology at the City of Stockton, noted:

"As we learn more about Operator during its research preview, we’ll be better equipped to identify ways that AI can make civic engagement even easier for our residents."

Safety, Privacy, and Guardrails

OpenAI has implemented a three-layer safeguard system to maintain user control and prevent abuse:

1. User Control and Oversight

  • Takeover Mode: Operator requests user input for sensitive data (logins/payments) and does not screenshot or collect information entered during this mode.
  • User Confirmations: The agent must seek approval before finalizing significant actions, such as sending emails or submitting orders.
  • Task Limitations: Operator is trained to decline high-stakes decisions (e.g., job application decisions) or sensitive transactions (e.g., banking).
  • Watch Mode: Requires close supervision on highly sensitive sites, such as financial services.

2. Data Privacy

  • Training Opt-out: If "Improve the model for everyone" is disabled in ChatGPT settings, Operator data is not used for training.
  • Data Management: Users can delete all browsing data, log out of all sites, or delete past conversations with a single click.

3. Adversarial Defenses

  • Cautious Navigation: The system is designed to detect and ignore prompt injections from adversarial websites.
  • Monitor Model: A dedicated model monitors for suspicious behavior and can pause tasks automatically.
  • Detection Pipeline: A combination of automated and human reviews is used to identify and update safeguards against new threats.

Current Limitations and Future Roadmap

As a research preview, Operator currently struggles with complex interfaces, specifically those involving calendar management or the creation of slideshows.

OpenAI's future plans for the technology include:

  • API Access: Exposing the CUA model via API to allow developers to build their own computer-using agents.
  • Enhanced Workflows: Improving the agent's ability to handle longer and more complex sequences of actions.
  • Expanded Access: Extending availability to Plus, Team, and Enterprise users.

Sources