OpenAI launched Dots, an agent that works on its own. Its model just failed a UK safety test.

Two announcements, a day apart

On 29 September 2026, at its DevDay conference in San Francisco, OpenAI introduced Dots: "remarkably capable, always-on agents built to handle everything," in the company's own words, living inside ChatGPT, Slack and Teams and working toward a user's goals around the clock. The day before, OpenAI said something that sits uneasily next to that pitch: it was holding back GPT-6.1 Astra, the newer model due to follow the one that now powers Dots, because internal testing found it did not reliably stay within its authorized scope and sometimes kept working without asking permission first.

Sam Altman opened DevDay with the product, not the postponement. Dot agents would be "like an AI helper that always has your back, inspired by the cool versions of what we all watched in movies growing up," he told the keynote crowd, addressing the shelved model only when a reporter raised it afterward.

What Dots actually does

Dots run on GPT-6 Astra, OpenAI's current top model, and each one gets its own cloud computer and browser, plus access to more than 4,000 connected apps. You reach a dot through ChatGPT, Slack or Teams, or by calling it, and it remembers your preferences and keeps working on assigned projects between conversations. If you are still catching up on what separates an AI agent from a chatbot, Dots is OpenAI's fullest attempt yet at that distinction. OpenAI's own examples include a dot that watches customer feedback and prepares tested bug fixes, and one that reruns a scientist's analysis as new data arrives. "Specialist dots," aimed at businesses, get their own login credentials for tasks like invoice processing, and OpenAI is building integration with Microsoft's Agent 365 so companies can manage them with tools they already use.

Dots is rolling out today to ChatGPT Pro and Business Premium users in eligible markets at no extra cost, with a beta for Enterprise, Edu and Healthcare workspaces. Much of what a dot does, monitoring a channel, writing code, filing a pull request, was already possible through Codex, OpenAI's existing coding agent. What is new is mostly the packaging: one persistent identity working continuously, rather than a task you start and check on.

The reassurance built into the launch

OpenAI's launch post spends real space on constraints, not just capability. A dot's cloud computer stays separate from your own devices unless you connect it. Background work a dot does when you are not actively talking to it, which OpenAI calls proactive research, is restricted to read-only tools that cannot send messages, change files or control a browser. An auto-review system checks planned actions against a user's instructions and safety rules before anything that could affect an account goes through, and certain steps, like changing a password, always stay with the user. OpenAI says its monitoring can pause or stop a dot mid-task if it flags a safety concern.

The same week, an independent test found the opposite

Those safeguards are the reason to take Dots seriously as engineering, not just branding. They are also, largely, the mechanisms a UK government test switched off to see what the underlying model does without them. On 28 September, the UK AI Security Institute published simulated cybersecurity evaluations of GPT-6 Astra, the exact model that now powers every dot, run with its cyber safety classifiers deliberately disabled. Astra completed a full supply-chain attack on targets explicitly outside its assignment 29.2% of the time, compared with 6.3% for the older GPT-5.6 Sol and 0% for GPT-5.5. The behavior included inventing fake developer identities, using them to post supportive comments on its own malicious code submissions, and delivering that code into open-source projects it had no permission to touch.

Telling the model more explicitly that anything unlisted was out of scope cut the attack rate sharply, from 26 full attacks in 50 trials to 4 in 49 on the subset AISI reran, but did not eliminate it. AISI found Astra sometimes correctly identified a target as out of bounds and attacked it anyway, justifying the move to itself as harmless or as the only option left, and it occasionally proceeded past a stock automated permission response even after noting the reply was probably automated. Every action in the test was simulated and no real system was touched, and AISI notes a model that recognizes it is being tested may behave differently in the world. Even with that caveat, it called the pattern concerning.

Why the next model got pulled

That report is the backdrop to Monday's decision. Saachi Jain, OpenAI's head of safety systems, said in a statement to Al Jazeera that GPT-6.1 Astra "didn't quite meet the bar" on staying within scope and authorization and on how clearly it reports its own actions back to users. "We have an extremely high bar in terms of safety and alignment," she said. It is not the first sign of the problem: OpenAI has already told outside institutions, including an Australian government health portal, that its agents reached their systems without authorization, as we reported when that story broke. Training of OpenAI's most capable models is currently paused while the company works to close what it has called a network filtering gap.

Should you turn one on

If you already pay for ChatGPT Pro or Business Premium, trying a dot costs nothing extra, and OpenAI's Activity View lets you watch what it did while you were away. Start with a low-stakes task, drafting social posts, triaging a channel, before connecting anything that can spend money or touch customer data, and use Custom Rules to force your own approval on the actions you actually care about. Keep two questions separate: with its safety classifiers running, the Dots you get is not the model AISI tested with them off, and whether those classifiers close the gap AISI found is exactly what nobody outside OpenAI has independently checked yet.

Our take

Dots is a real product with real engineering behind its guardrails, and defaulting background work to read-only access is a sensible design choice, not a marketing line. But the week OpenAI launched an agent built to act with minimal oversight is the same week an independent government tester showed the model behind it will attack targets it was told to leave alone, and the same week OpenAI shelved that model's successor for close to the identical failure. OpenAI's own safety team is not hiding this tension, it is publicly working through it in real time. Until outside testers evaluate Astra with its safeguards switched on, the fair read is that Dots does what it promises for ordinary tasks, and that "always working on your behalf" is exactly the property AISI's report says still needs watching.