OpenAI Introducing ChatGPT agent

OpenAI has introduced ChatGPT agent, a system capable of executing complex, end-to-end tasks by operating its own virtual computer. By integrating the web-interaction capabilities of Operator, the synthesis skills of deep research, and the conversational fluency of ChatGPT, the agent can navigate websites, run code, and deliver editable professional artifacts like slideshows and spreadsheets.

Unified Agentic Architecture

ChatGPT agent is built on a unified system that merges three previously distinct capabilities into a single model. This integration allows the agent to transition fluidly between reasoning and action, overcoming previous limitations where Operator lacked deep analytical depth and deep research lacked the ability to interact with websites or handle authenticated content.

Tool Suite and Technical Execution

To perform tasks, the agent utilizes a virtual computer equipped with a specific suite of tools:

  • Visual Browser: Interacts with the web via a graphical user interface (GUI) for human-centric websites.
  • Text-based Browser: Handles simpler, reasoning-based web queries for efficiency.
  • Terminal: Executes commands and runs code.
  • Direct API Access: Connects to services for structured data retrieval.
  • ChatGPT Connectors: Integrates with apps such as GitHub and Gmail to access user-specific information.

This architecture allows the model to choose the most efficient path for a task. For example, it can retrieve calendar data via API, reason over text using the text browser, and interact with a GUI for final execution.

Performance Benchmarks

ChatGPT agent demonstrates state-of-the-art (SOTA) performance across several expert-level and real-world benchmarks:

  • Humanity’s Last Exam (HLE): Achieved a pass@1 SOTA score of 41.6, which increases to 44.4 when using a parallel rollout strategy (eight attempts).
  • FrontierMath: Reached 27.4% accuracy using terminal access for code execution, significantly outperforming previous models.
  • BrowseComp: Set a new SOTA of 68.9%, representing a 17.4 percentage point increase over deep research.
  • SpreadsheetBench: Outperformed existing models, scoring 45.5% when given the ability to edit spreadsheets directly, compared to 20.0% for Copilot in Excel.
  • WebArena: Showed improvement over the o3-powered CUA (the model powering Operator).
  • Investment Banking Tasks: Significantly outperformed deep research and o3 on internal benchmarks for first- to third-year analyst modeling tasks, such as leveraged buyout models.
  • Knowledge Work: On an internal benchmark for economically valuable knowledge-work tasks, the agent's output was comparable to or better than humans in roughly half of the cases.

User Control and Collaborative Workflow

ChatGPT agent is designed for iterative collaboration rather than autonomous isolation. Users maintain control through several mechanisms:

  • Interruption and Takeover: Users can interrupt the agent at any point to clarify instructions or take over the browser manually to handle logins or steer the outcome.
  • Permission-based Actions: The agent is trained to request explicit permission before taking actions with real-world consequences, such as making a purchase.
  • Watch Mode: Critical tasks, such as sending emails, require active user oversight.
  • Notifications: Mobile app users receive notifications upon task completion.
  • Scheduling: Users can schedule completed tasks to recur automatically (e.g., weekly reports).

Safety and Risk Mitigations

OpenAI has implemented a comprehensive safety stack to address the expanded risk profile of an agent that can take direct action on the web.

Adversarial Manipulation and Prompt Injection

Because the agent encounters live web content, it is susceptible to prompt injection—where malicious instructions hidden in webpages trick the agent into sharing private data or taking harmful actions. Mitigations include:

  • Specialized training to identify and resist prompt injections.
  • Continuous monitoring to detect attacks.
  • Requirement of explicit user confirmation for consequential actions.

Model Mistakes and Data Privacy

To prevent autonomous errors, the agent proactively refuses high-risk tasks like bank transfers. Privacy is managed through "takeover mode," where inputs (such as passwords) remain private and are not collected or stored by the model. Users can also delete all browsing data and log out of all sessions with a single click.

Biological and Chemical Risk

Under the Preparedness Framework, ChatGPT agent is classified as having "High Biological and Chemical capabilities." This triggers a comprehensive safety stack including dual-use refusal training, reasoning monitors, and always-on classifiers.

Availability and Limitations

ChatGPT agent is currently rolling out to Pro, Plus, and Team users via the "agent mode" option in the tools dropdown. Enterprise and Education users will receive access in the coming weeks. Pro users are limited to 400 messages per month, while other paid users receive 40 messages monthly.

Current Limitations:

  • Slideshow Creation: Currently in beta. Formatting and polish can be rudimentary, and there is no current support for uploading existing slideshows as templates (unlike spreadsheets).
  • Regional Availability: Access is still being enabled for Switzerland and the European Economic Area.

Sources