ChatGPT Work: Web Code, Scriptable Chrome, and Deployed Sites

OpenAI reserves ChatGPT Work for paying subscribers and focuses on features absent from the classic chat. The offerings include a coding environment connected to the Internet, a headless Chrome browser, persistent storage, sub-agents, and site deployment via Cloudflare. These additions come with a different range of models and uncertainties regarding security.

Security: Accumulation of Risks and Expected Responses

A model described as a "lethal trifecta" raises alarms about the risks associated with agent systems that combine access to private data, exposure to unreliable content, and the ability to communicate information externally. All three elements are present in ChatGPT Work. The author expresses doubts about the overall security level and hopes that OpenAI will clarify the protections against prompt injection attacks, expecting a self-review mechanism similar to that of Codex. These concerns arise even as Work's code execution environment can access the Internet.

Paid Access and Distinct Model Selection from Chat

Announced on July 9, ChatGPT Work is reserved for subscribers at $20 per month and above, while free users and those at $8 per month do not have access. It consolidates functions unavailable in ChatGPT Chat and offers an expanded selection of models: in Work, users can select GPT-5.6 in Sol, Luna, or Terra variants with reasoning levels ranging from Light to Ultra, as well as GPT-5.5 from Light to Extra High. In Chat, the selection differs: 5.6 Instant, Medium, High, Extra High, and Pro, with the latter two reserved for subscribers at $100 per month and above, while $20 grants access to High. Chat does not specify whether it uses Sol, Luna, or Terra, and 5.6 Pro appears exclusive to chat. Ultra is understood as a mode that delegates more to sub-agents. The models available in Work seem aligned with those of the API, and it is reported that Work would be counted against a separate Codex quota from that of Chat, which could explain differences in availability. OpenAI recommends chat for short responses or drafts, and Work for tasks with clear outcomes. It is also reported that OpenAI has intensified the development of Work and that the official usage distinction is deemed unhelpful by the author.

Web-Connected Code: Package Installation and GitHub Repositories

ChatGPT Work includes a code execution environment capable of accessing the Internet. In contrast, in Chat, attempts to install packages or interact with sites or APIs are blocked by the container's proxy; it is reported that an installation capability observed in January no longer seems active. In Work, access may be limited to a list of authorized domains, with a default setting perceived as open, allowing for cloning GitHub repositories, installing their dependencies, and interacting with the web. In comparison, the equivalent container of Claude has allowed restricted access since its launch in September: installation via PYPI and NPM and GitHub cloning, but with a very short list of authorized domains.

Controllable Chrome Browser: Forms, 2FA, and DOM Scripts

Work Cloud offers a browser that allows users to start a full Chrome session, visit sites, fill out forms, and take screenshots. When authentication is required, users can directly enter their passwords and 2FA codes without them passing through the model. The browser can execute JavaScript on the DOM of loaded pages, as illustrated by an extraction of titles via a short script. This capability is compared to a JavaScript scraping tool, now accessible from a phone via Work.

Shared Persistent Storage: A /workspace Visible Between Sessions

Unlike the classic chat where each session has a non-shared ephemeral file system, Work offers persistent storage. Each session has a temporary folder of the type /workspace/scratch/<id> that remains accessible from one session to another. It is reported that 171 folders coexist in this directory and that the /workspace volume seems mounted on all ongoing sessions, making changes instantly visible. However, process spaces remain isolated: a localhost server launched in one session is not accessible from another.

Work Enables the Creation and Deployment of Websites

Work allows for the publication of ChatGPT Sites built and deployed via Cloudflare Workers. These sites can incorporate HTML and JavaScript, utilize server-side functions, and manage state with Cloudflare D1 and R2. A public example is cited, while by default, the sites remain private to their author, with options for public visibility and targeted sharing in team plans. Work can also launch sub-agents—a feature absent from Chat—presented as useful for complex projects. Finally, Work manages scheduled prompt automations, with execution at fixed times and notifications for new updates; this function also seems available in Chat and can integrate with other components of Work, for example, to refresh a site at regular intervals.

Clarity of the Offering: Use Cases, Capabilities, and Documentation

It is reported that Work consolidates functions that do not exist in the classic chat, while OpenAI's communication emphasizes use cases rather than a list of actual capabilities. The absence of publication of system prompts and tool descriptions for Work is also noted. According to the author, understanding the whole required substantial effort. The detailed elements pertain to the cloud version, referred to by the author as Work Cloud, in contrast to the local version.