News · 2026-09-30

OpenAI launches persistent dots, but pausing one does not stop its delegates

OpenAI launched dots on September 29 as persistent assistants with a cloud computer, browser, memory, and access to user-connected apps. Its published controls reveal an important operational limit: pausing a dot stops its main task but leaves delegated tasks and scheduled runs to be stopped separately. The launch turns agent management into an ongoing responsibility, with permissions and stopping behavior as consequential as model capability.

Key facts

• OpenAI says a dot can work toward goals “24/7,” with finite deeper-work allowances.
• Dots were announced on September 29, 2026, powered by GPT-6 Astra.
• The first dot is included with eligible Pro or Business Premium subscriptions.
• Primary source: OpenAI’s dots launch post.

A conventional assistant waits for another message. A persistent agent can return to a project, check for a change, or start a previously authorized task while its owner is elsewhere. The appeal is reducing the repeated explanation and manual restarting that interrupt complex work. The complication is that the project becomes a running system: an instruction, a connected account, a schedule, and another agent can each keep part of it alive.

OpenAI’s phrase “24/7” describes availability to pursue goals. The getting-started guide does not establish unlimited continuous execution, a maximum unattended task duration, or a precise deeper-work quota. Work handed to Codex or ChatGPT Work draws on those products’ allowances. The distinction is like having an office open all day with a finite staffing budget: the door remains available, but the amount of work still has a cost and a limit.

The permission model has several layers. Users choose connected apps; each service’s authorization constrains access; workspace administrators can control capabilities; task instructions and custom rules determine which actions are already authorized. OpenAI’s safety explanation says proactive background research uses read-only tools. Other tasks can take action when the user has already granted the relevant authority. The agent does not need a fresh confirmation for every harmless step.

Some actions retain mandatory gates. Purchases require approval. Permanently deleting data, running software from an unrecognized source, and granting new security-sensitive access require confirmation each time. Password changes and money transfers are handed back to the user. Sending information requires authorization that covers both its content and the recipient class, with more sensitive information requiring more specific recipients. Those details turn an apparently simple instruction such as “handle this” into a question of the actual boundary of delegated authority.

Stopping is similarly layered. The published controls distinguish the dot’s main activity, work it has delegated, and recurring schedules. Disconnecting an app cuts off future reads; it does not remove remembered information. Resetting or deleting the dot removes its conversations, memories, and schedules, but cannot undo an external edit or recall a sent message. OpenAI has not published a general retention period for all dot context and activity records in the checked material. Agent memory is therefore part of the control surface.

OpenAI’s own tests provide a stronger counterargument than speculation. In its Astra system card, permission-scope flags rose from 8.6% to 19.7% when five to ten tasks intervened in a chain. The company reports no severe breach or exfiltration in that test. It also reports no scored success in specified malicious-email simulations. These are targeted internal evaluations with defined setups; neither the successes nor the failures are production incident-rate estimates.

The chain result nevertheless identifies a practical mechanism: remembering that an account is connected is easier than preserving which task authorized which use of that account. An assistant can correctly follow a direct permission change yet later infer too broad a mandate from accumulated context. That is why scoped credentials and an activity history matter even when the model appears cooperative. A task boundary needs to survive handoffs and time.

The launch’s live demonstrations added a separate reliability concern. Simon Willison’s firsthand live account records a stalled catch-up and a later build-thread error. The research record distinguishes those from another speaker’s voice-mode failure. They demonstrate operational friction, not a security escape. Community ridicule and the defense that live demos reveal real behavior both have a factual basis, but neither constitutes a reliability study.

At launch, regional and workspace eligibility also differed, and initial creation required desktop setup. The workspace management guide is more useful than assuming every announced feature is enabled everywhere. Dots are a substantial product move toward ongoing delegation. Their usefulness will depend on completed work, while their governability depends on whether owners can inspect and stop every part of that work.

Primary source, verified: read the paper →

Ground Truth. (2026, September 30). OpenAI launches persistent dots, but pausing one does not stop its delegates. Ground Truth. https://groundtruth.day/news/openai-dots-launch-with-separate-stop-controls.html

@misc{groundtruth:openai-dots-launch-with-separate-stop-controls,
  title  = {OpenAI launches persistent dots, but pausing one does not stop its delegates},
  author = {{Ground Truth}},
  year   = {2026},
  month  = {sep},
  url    = {https://groundtruth.day/news/openai-dots-launch-with-separate-stop-controls.html}
}

Topics: agents · openai · product-release · permissions · agent-memory