On September 29, OpenAI shipped an agent that does not stop.
They are called dots — lowercase, in OpenAI's own copy — "always-on agents built to handle everything." Each gets its own cloud computer and browser, connects to more than 4,000 apps through plugins, and lives in ChatGPT, Slack or Teams, reaching you with "progress, questions, or decisions that need you." OpenAI's example of one earning its keep belongs to an early tester: his dot noticed he had forgotten to invoice a publication, prepared the invoice, and sent it after his approval.
That last clause is the whole piece. Read past the headline and most of the announcement is not about capability.
Count the paragraphs
The capability takes a handful of them. Then comes a long, careful accounting of where the agent stops.
Dots start with built-in rules for when to act alone and when to ask. Custom Rules let you widen, narrow or block specific actions — and a dot can help draft its own rules but needs your approval to change them. Before it sends an email or edits a file, a separate system called Auto-review checks the planned step against your instructions, your Custom Rules and OpenAI's safety requirements, then decides what proceeds, what needs approval, and what you have to do yourself (OpenAI's safety page for dots). When nobody is talking to it, a dot does "proactive research" with read-only tools — and OpenAI is explicit that this is enforced in code, not asked for politely: those background tasks cannot message anyone, change content in a connected app, or drive a browser.
Below that sits a tier list of consequence. Sharing health data requires you to name the recipient. Sharing a phone number requires a class of recipient — "any airline company" — unless you deliberately widen it. Purchases need approval. Permanent deletion needs confirmation every time. Changing a password or moving money between accounts never gets delegated at all: the dot does the surrounding work and hands that step back to you.
None of this is boilerplate. It is a specification for a role — what the work is, what it may touch, and where a human reads it before it goes out.
The sentence underneath the announcement
The tell is further down, where OpenAI describes "specialist dots," the version that takes a real job inside a company. Each gets its own identity, its own credentials, its own access. And then:
Our engineering teams will work directly with organizations to define each dot's responsibilities, the tools it can use, and how people review and approve its work.
They are starting with "focused enterprise pilots."
The lab holding one of the most capable models on earth cannot ship a specialist agent as a product you buy. It has to send people to your building to write the job description. The intelligence is ready; the definition of the work is not, and no amount of model capability supplies it, because it was never a model problem.
Intelligence got cheap. This didn't.
The same week made the first half of that trade impossible to miss. OpenAI's GPT‑6.1 Sol nearly matches its frontier Astra model on agentic coding, computer use and professional work at one-fifth of Astra's token price — on a benchmark of long-horizon software engineering in real codebases it matches Astra outright at roughly a fifth of the cost. Google shipped Gemini 4 Argon the next day. Anthropic had shipped Sonnet 5.5 the day before. The capability everyone was waiting for arrived at a discount, from three vendors at once. If frontier intelligence were the constraint on getting work off your plate, this would be the week it broke.
It isn't, and the industry said so out loud. Nvidia opened the week by releasing a platform whose entire purpose is keeping agents inside their lane — Jensen Huang's framing was that "you can't have agents roam around and drift around the company, and so you have to find a way to container it." His enterprise AI VP put the technical version more plainly: "model-level safeguards alone can't govern what agents can access or do." A chip company spent its announcement on permissions. That is not a safety story. That is the market locating the remaining work.
What a job description actually is
Strip the enterprise framing and the artifact OpenAI's engineers fly out to produce is three lines long:
The outcome. Not the task — the finished state, specific enough that two people would agree whether it happened. "The invoice is sent" is an outcome. "Help with billing" is a wish.
The surface. What it may read, what it may write, what it may never touch. Read and write are different permissions and most tooling blurs them. Scope them separately or you have scoped neither.
The approval point. Where a human reads the work before it leaves the building. OpenAI put theirs at sending, spending, deleting and credentials; yours will differ. The requirement is that it is a specific moment, not a general intention to pay attention.
That is the thing being built. It is not a template, not a prompt, and it does not come with the model.
Why this favors a small team
That artifact is cheap to write when you are two people and expensive when you are two thousand. Not because of complexity — because of agreement. A small shop knows what the outcome is. It knows who signs off, because it is probably the person asking. It can define a role on Tuesday, watch it run on Wednesday, and change it on Thursday without consulting anyone. The enterprise version of that sentence requires an engineering engagement from OpenAI and a governance integration with Microsoft.
That is the asymmetry, and it is the opposite of the one everyone expected. Everybody has the same model now, at a fifth of last month's price. What separates operators from here is how precisely they have defined the work — and precision about your own operations is not a scale advantage.
The honest version
Writing those three lines is harder than it reads, and the reason is uncomfortable: for most recurring work, nobody has ever written any of it down. The outcome lives in one person's head. The approval point is "I'd probably notice." You find this out the moment you try to delegate — to an agent or to a new hire, and the failure is identical, which should tell you the agent was never the variable.
Our own work runs this way. Agents do the work overnight; it lands as a pull request a person reads and approves in the morning. That approval point is not a safety feature we bolted on. It is what made the delegation possible — the delegation started paying off at exactly the point the review step became specific.
And the limits are real. A defined role does not make an agent correct. OpenAI, having built all of the above, closes with the only sentence that can honestly close it: "Dots can still make mistakes, so always review consequential work."
So the question this week is not which agent to buy. Take one piece of work you repeat, and write down the outcome, the surface, and the approval point. Three lines.
If you can't, you have found the actual bottleneck — and it was never going to be fixed by a better model.
