OpenAI Operator System Card

OpenAI has announced Operator, a research preview of its Computer-Using Agent (CUA) model. Operator combines GPT-4o's vision capabilities with reinforcement learning to interpret screenshots and interact with graphical user interfaces (GUIs) using a cursor and keyboard, allowing it to perform everyday browser-based tasks such as booking reservations or ordering groceries under user oversight.

Technical Architecture and Training

Operator is designed to perceive and interact with a computer screen exactly as a human would. Its development relies on two primary training methodologies:

  • Supervised Learning: Used to establish base-level perception and input control, enabling the model to read screens and accurately click UI elements.
  • Reinforcement Learning: Used to develop higher-level capabilities, including complex reasoning, error correction, and adaptation to unexpected events.

Training data included a mix of publicly available machine learning datasets, web crawls, and specialized datasets developed by human trainers demonstrating task completion on a computer.

Safety Framework and Risk Identification

OpenAI utilizes a multi-layered safety approach to address three primary risk vectors: misaligned users (harmful tasks), misaligned models (mistakes), and misaligned websites (prompt injections).

Frontier Risk Assessment

Evaluated under OpenAI's Preparedness Framework, Operator's risk levels are as follows:

  • CBRN (Chemical, Biological, Radiological, and Nuclear): Low. In biorisk tooling evaluations, Operator achieved a 1% success rate, struggling with OCR and long DNA sequences.
  • Cybersecurity: Low (inherited from GPT-4o).
  • Persuasion: Medium (inherited from GPT-4o).
  • Model Autonomy: Low. In autonomous replication tests, the model struggled with code editing and terminal tasks due to its visual-only input modality, scoring below 10% on all main tasks.

Mitigating Harmful Tasks

Operator is trained to refuse harmful tasks, achieving a 97% refusal rate for agentic harms (such as illicit activities or prohibited financial transactions) on internal evaluation sets. System-level restrictions prevent the model from navigating to websites that facilitate prohibited activities. Specific prohibited uses include:

  • Facilitating illicit activity or compromising privacy.
  • Defrauding, scamming, or impersonating others.
  • Automating high-consequence regulated activities, such as stock trading.
  • Creating content used to harass or defame others.

Addressing Model Mistakes

To prevent irreversible errors (e.g., sending an email to the wrong recipient), OpenAI implemented several safeguards:

  • Confirmations: The model is designed to ask for user confirmation before finalizing actions that change the state of the world. This mechanism achieved a 92% recall rate across 20 risky action categories.
  • Proactive Refusals: High-risk tasks, such as banking transactions, are proactively refused with a 94% recall rate.
  • Watch Mode: For sensitive sites (e.g., email services), Operator automatically pauses execution if the user becomes inactive or navigates away from the page.

Defending Against Prompt Injections

Prompt injections occur when a model follows malicious instructions found on a third-party website. OpenAI reduced susceptibility from 62% (unmitigated) to 23% through model-level robustness. Additionally, a dedicated prompt injection monitor was implemented, achieving 99% recall and 90% precision in detecting and pausing execution during suspected attacks.

API Availability and Developer Guidance

As of March 11, 2025, the CUA model is available as computer-use-preview for select developers (Tiers 3-5). OpenAI notes that the model is currently less reliable in non-browser environments, with a 38.1% success rate on OSWorld.

To mitigate API-specific risks—such as higher-scale misuse or increased jailbreak potential via system message modification—OpenAI provides:

  • Containerized Starter Setup: A Docker application to encourage the use of isolated environments.
  • Safety Checks: Integration of prompt injection and sensitive domain checks into the API.
  • Enhanced Monitoring: Expanded detection for suspicious usage patterns and policy violations.

Current Limitations

Operator is in its early stages and performs best on short, repeatable tasks. It currently faces challenges with complex environments like calendars and slideshows. Because adversarial robustness remains an open research problem, OpenAI continues to iterate on safety measures based on real-world observations from its limited research preview rollout.

Sources