Inside OpenAI’s dots: shared app permissions, retained context and action checks

OpenAI announced dots at DevDay 2026 and began rolling them out on 29 September 2026. The persistent agents can continue working between conversations, connect to external services and take authorised actions on users’ behalf. That design puts permission boundaries, retained context and resistance to manipulated instructions at the centre of the product.

At launch, access was rolling out to Pro and Business Premium users in eligible markets. Enterprise customers, including Edu and Healthcare users, could try an administrator-enabled beta. OpenAI said the first dot was included at no extra cost.

The product is powered by GPT-6 Astra and gives each dot its own cloud computer and browser. OpenAI says dots can connect to more than 4,000 apps and can be contacted through ChatGPT, Slack and Teams, with texting planned. That combination distinguishes a dot from an ordinary ChatGPT conversation: it is designed to preserve working context and continue tasks while a user is not actively chatting with it.

Read-only research is not a universal limit

OpenAI has placed a specific restriction on proactive research conducted by dots. In that mode, the agent can use read-only tools but cannot directly send messages, alter content in a connected app, or control a browser or computer. This limits what an unattended research process can change, but it does not mean every dot workflow is read-only.

For other authorised work, users select the connected apps and can establish Custom Rules. OpenAI says an Auto-review system checks certain planned actions, while some sensitive steps require explicit confirmation or a handover to the user. The company presents model safeguards, restricted tools, checks and monitoring as layers intended to reduce unintended actions and disclosures. Their effectiveness in public deployment has not yet been independently established at meaningful scale.

The distinction matters because an agent’s practical reach depends on both the services connected to it and the tasks a user permits. A confirmation requirement can put a human decision in front of a sensitive action, while read-only proactive research reduces the changes an agent can make without an active instruction. Neither control removes the privacy implications of allowing the agent to read information across connected accounts.

Disconnecting an app does not erase retained context

OpenAI’s privacy documentation describes permissions that extend beyond a single dot. Plugin permissions are shared across dots, ChatGPT, ChatGPT Work and Codex. Disconnecting an app prevents new access, but information already incorporated into a dot’s context is not erased by that step.

Memory has a similar boundary. A dot can receive ChatGPT memories and recent conversation context. Turning off the Memory setting stops future sharing, according to OpenAI, but does not remove information the dot has already received. Revoking a connection and deleting retained information are therefore separate actions with different effects.

A dot can retain its context for as long as it exists. Users cannot currently inspect or remove individual dot memories, and deleting the dot does not delete files, conversations or ChatGPT memories stored separately. Anyone reviewing retention therefore has to consider several locations: app permissions, the dot’s own context, ChatGPT memory and material held elsewhere in the service.

The training controls also differ by account type. OpenAI says data from Business, Enterprise and Edu workspaces is not used for model training by default. Personal-plan users can control eligible use through the model-improvement setting. The company’s documentation says limited human review may still occur when that setting is disabled, so disabling model improvement does not also remove the documented possibility of limited human review.

These are documented platform rules rather than evidence of improper access or a data breach. They do, however, show why deleting a connection is not the same as reversing all earlier information sharing.

Internal tests found strengths and residual weaknesses

OpenAI’s GPT-6 Astra system card reports favourable results from two automated prompt-injection evaluations. In one test, there were no scored attack successes across 100 bulk email rollouts containing 16,600 attack emails. A separate iterative test recorded no scored successes across 2,638 valid attempts.

Those results cover selected testing conditions. They do not establish that dots are immune to prompt injection, in which untrusted content attempts to redirect an agent’s behaviour. OpenAI’s manual red-teaming identified opportunities to improve the handling of sensitive disclosures and confirmations. The company changed policies in response and said known vulnerabilities remained, although exploiting them generally required substantial setup, permissive prompts or advanced techniques.

Separate evaluations examined whether the system continued despite warnings or moved beyond the intended scope of a long workflow. In the warning-respect evaluation, unwanted persistence appeared in 15.0% to 17.4% of rollouts, depending on the simulated time budget. That result measures a different behaviour from the automated prompt-injection tests and should not be combined with them into one overall failure rate.

In chained-task testing, moderate scope-violation flags increased as more tasks intervened. The rate rose from 8.6% with five intervening tasks to 19.7% with ten. The tested set produced no severe breach or exfiltration, but OpenAI cautions that these difficult-case evaluations are not estimates of how frequently problems will occur in ordinary production use.

Taken together, the evaluations support a narrower conclusion than either blanket reassurance or blanket alarm. The automated tests indicate that safeguards resisted the scored attacks used in those exercises. The manual findings and the persistence and scope results show that confirmation handling, adherence to warnings and long-running task boundaries remain relevant areas of risk.

What users and administrators need to verify

Before enabling a dot, the documented control model calls for a review of which apps are connected, how their shared permissions apply across OpenAI products, what Custom Rules are set and which actions require approval or takeover. Memory settings and deletion expectations need separate attention because stopping future access does not clear context already received.

Workplace administrators also need to distinguish product availability from a universal launch. OpenAI described a staged rollout to specified plans in eligible markets, with Enterprise access requiring an administrator-enabled beta. The available research did not establish the complete market list, including whether the service was available in Australia at launch.

The largest unanswered question is how the controls perform during varied, sustained public use. The available research contained no independent hands-on assessment or third-party audit of the production safeguards, and real-world rates of prompt injection, unintended disclosure, scope drift and Auto-review errors remain unknown.

For now, the key distinction is between removing future access and removing previously retained information. OpenAI documents controls for connections, memory sharing, approvals and deletion, but those controls operate at different layers. Users and administrators assessing dots will need to manage each layer separately rather than treating one revoked permission as a complete reset.

Mapping where connected information can travel and remain, alongside where human approval enters a task, creates a useful framework for assessing persistent agents. Develop those foundations with The Hack Academy’s online cybersecurity training programme, featuring self-paced study in cybersecurity fundamentals and cloud security, with practical exercises alongside theory.