OpenAI's ChatGPT Work adds internet-connected code execution and browser automation

Full analysis

Your draft

OpenAI shipped an agent that runs code with live internet access, drives a headless Chrome browser, keeps a filesystem across sessions, and deploys websites to Cloudflare Workers. Anthropic looked at the same capability, specifically the open outbound network path, and decided it was too dangerous to ship. OpenAI shipped the inverse and hasn't published a threat model. That's the story for anyone building with these things.

Reversibility: Type 2 for you, Type 1 for OpenAI. Trying ChatGPT Work for a workload is a cheap experiment you can walk back. OpenAI's decision to ship an internet-connected sandbox to millions of $20/month users is the hard-to-reverse one, and you inherit its blast radius if you build on top.

What's actually being decided: Not "is this a cool agent." It's whether you route real work, with real data, through a platform whose security posture nobody outside OpenAI can see. And whether the custom agent orchestration your team has been maintaining just became scaffolding you're paying to keep alive.

Forcing function: None hard. The product is live and iterating fast, so the cost of waiting is low. Willison's writeup is the only detailed public account, which is itself a signal about how much you actually know here.

The Skeptic. One developer's weekend writeup is not a product spec. Simon Willison is as good as it gets, but "headless Chrome that fills forms" is Playwright from 2019 with a chat wrapper on it. The capability list reads transformative because it's a list. Every agent product has looked exactly this good in launch week and then face-planted on three-hop dependency chains in production. Show me task completion at non-demo complexity before I call this a platform. And the $20 paywall means the stress-testing happens on consumer traffic, not controlled evals, so the reliability data you actually need won't exist for months. For a PM: the demo always works; the question is whether it works on the tenth step of a real task.

The Safety Lens. Willison's "lethal trifecta" is a precise attack surface: private data, untrusted web content, and an outbound channel, all in one session. Here's the concrete chain. A malicious webpage loads in the headless browser, JavaScript reads a file off the persistent filesystem, and the same session makes an outbound HTTP call to ship it somewhere. That's not hypothetical, that's the architecture. Anthropic blocks outbound from its sandbox on purpose. OpenAI opened it and said nothing about mitigations. The silence is the choice. For a PM: this agent can be tricked by a web page into stealing your files and mailing them out, and we don't know what stops it.

The Researcher. Each piece exists elsewhere. The composition is what's new: persistent filesystem, live code execution, JS-executing browser, and edge deployment in one substrate. The interesting open question is whether parallel sub-agents produce coherent long-horizon completion or just louder, more expensive failure. The model taxonomy, Sol/Luna/Terra crossed with Light-through-Ultra reasoning tiers, tells you OpenAI is running live capability experiments on paying users. That's a lot of A/B data on agentic reliability. None of it will get published. For a PM: OpenAI is learning what makes agents work by watching millions of people use them, and keeping the answers.

The Enterprise Buyer. Nothing here is signable yet. A $20/month consumer tier with an undocumented threat model, session state that may bleed between parallel sub-agents, and a persistent shared filesystem is a data-residency and audit nightmare before you even get to prompt injection. No CISO approves outbound-enabled code execution touching internal data without a published mitigation story and indemnification. The scheduled automations will hit tier walls the moment a team runs them at volume, which means an enterprise SKU is coming, and the real terms live there. For a PM: your security team will say no to this in its current form, and they'll be right.

The Builder. Forget the strategy, here's Tuesday. Native persistent filesystem plus internet-connected execution is the exact thing we've been duct-taping for two years. Cloudflare Workers deploy from inside the agent collapses the build-then-ship loop to nearly nothing. That's real. But the first breakage in 90 days is rate limits and state bleed between parallel sub-agents, so build your idempotency and error-handling layer before day one, because this will silently retry and you'll pay for it twice. And be honest with yourself: the custom orchestration your team is proud of just got commoditized. Sunk cost will tempt you to defend it. For a PM: the plumbing we hired three engineers to maintain is now a product feature.

Where they split. The Builder sees native plumbing worth adopting now. The Safety Lens sees a documented exfiltration path with no published defense. Those two don't reconcile: the same open-outbound design that makes deployment frictionless is the thing that makes the attack chain work. You can't take one without the other.

The second split is Skeptic versus Researcher on what the model taxonomy means. The Skeptic reads Sol/Luna/Terra as marketing noise on an unproven product. The Researcher reads it as OpenAI running the largest live agent-reliability experiment ever, on your dime. Both can be true, and if the Researcher's right, the reliability the Skeptic wants proven will improve fast, just invisibly.

What it hinges on. Two beliefs. First: does the open-outbound sandbox get exploited in the wild before OpenAI publishes a mitigation? The architecture says the attack is feasible; the only question is timing and whether anyone bothers. Second: does multi-agent parallelism actually complete long-horizon tasks, or just fail louder? You can't answer the second from a writeup. You can partly de-risk the first by never pointing this thing at data you'd hate to lose until the threat model is public.

Before you commit: run your own eval on a real three-to-five-hop task with dependencies, not a demo. Load-test the scheduled automations against tier limits before you design a workflow around them. And treat the persistent filesystem as untrusted shared space until OpenAI documents session isolation, because state bleed between parallel sub-agents is the kind of bug that leaks one user's data into another's context.

Prediction: Before OpenAI publishes a documented prompt-injection threat model or mitigation writeup for ChatGPT Work's internet-connected sandbox, a working data-exfiltration proof-of-concept exploiting the open-outbound code execution path will be published by an independent security researcher, by 2027-01-15.

Confidence: Medium. The attack path is architectural, and OpenAI's silence invites the demonstration.

Why: Willison's exfiltration chain is a direct consequence of shipping private data, untrusted web content, and an open outbound channel in one session. OpenAI chose that architecture; Anthropic refused it. When a capability this exposed ships with no published mitigation, security researchers treat that gap as an invitation, and a headless-Chrome-plus-outbound-HTTP proof-of-concept is a weekend project for the people who write these blog posts. The opposite outcome, OpenAI getting ahead of it with a published threat model first, runs against their revealed behavior here: they shipped the open design quietly and let Willison document it for them, which is not the posture of a team about to volunteer its attack surface.

Revisit by 2027-01-15: We're right if an independent researcher publishes a working file-exfiltration or data-leak PoC against ChatGPT Work's internet-connected sandbox before OpenAI publishes a threat model or mitigation document for it. We're wrong if OpenAI publishes that mitigation writeup first, or if no such PoC appears by the date.

The tension worth watching is that OpenAI's incentive is to keep the frictionless deploy-and-execute loop, because that loop is the product. Every mitigation that closes the outbound path makes it more like Claude's sandbox and less like the thing Willison called wild. That is why the silence holds: explaining the mitigation means either admitting it's weak or admitting they narrowed the capability.