OpenAI launches ChatGPT Agent to browse and complete tasks

On July 17, 2025, OpenAI introduced ChatGPT Agent with a virtual computer and tool use. The original source supports the documentary core of the event; completing a demonstration does not remove errors, excessive permissions or irreversible actions.

The new capability combines Operator’s ability to click and type on web pages with Deep Research’s ability to research and synthesize information. The result is a more ambitious product: it doesn’t just respond to a request, but can string together the steps needed to carry it through.

From answering questions to doing work

A user can ask it to review their calendar and prepare a report on upcoming meetings based on recent news, compare competitors and create a presentation, or update a spreadsheet with financial data while preserving its formatting.

To do this, ChatGPT Agent combines several tools. It has a visual browser that interacts with websites much as a person would; a text-based browser that is more efficient for locating and processing information; a terminal for running commands and code; and direct access to certain APIs. It can also connect to services such as Gmail or GitHub if the user authorizes it.

The key difference is that it maintains context across tools. It can locate a file on the web, download it, process it in the terminal and open the result in the browser. That continuity is what turns several standalone features into an agent: a system that plans a sequence of actions to achieve a goal.

When it needs to sign in to a website, the user takes control of the virtual browser to enter their credentials. OpenAI also says the agent asks for confirmation before taking consequential actions, such as making a purchase or sending something. The task can be interrupted, redirected or stopped at any time.

Available to paying subscribers

Agent mode is available starting today to ChatGPT Pro, Plus and Team users through the tools menu. Pro users get 400 agent messages per month; Plus and Team users get 40. OpenAI plans to bring it to Enterprise and Edu later this summer. Document supporting the figure.

The message limits reveal that this is not an inexpensive feature to operate. Each request may involve browsing dozens of pages, running code and keeping a virtual computer active for minutes at a time. It also marks a difference from conventional ChatGPT: here, the unit of use is not a response but a potentially lengthy task.

Better benchmark results, but proceed with caution

OpenAI says the model powering the agent scores 41.6% on Humanity’s Last Exam, a test of expert-level questions across multiple disciplines. With up to eight parallel attempts and by selecting the answer the system reports as having the highest confidence, the score rises to 44.4%. Document supporting the figure.

On FrontierMath, a set of novel and particularly difficult math problems, it scores 27.4% with access to tools such as the terminal. On BrowseComp, a test of finding information that is difficult to locate online, it reaches 68.9%—17.4 percentage points above Deep Research, according to the company. Document supporting the figure.

One figure is especially relevant to office work: on SpreadsheetBench, which measures the editing of realistic spreadsheets, the agent scores 45.5% when it can edit the file directly. OpenAI compares that result with Copilot’s 20% in Excel, although the evaluation was run on macOS and LibreOffice, not the Windows and Excel environment used by the benchmark’s authors. Document supporting the figure.

Benchmarks help measure progress, but they do not make the agent a reliable unsupervised employee. Many results come from OpenAI’s internal evaluations, and success on a benchmark task does not guarantee that a model will correctly interpret ambiguous instructions, changing data or business exceptions.

The problem with giving a model the power to act

ChatGPT Agent’s main innovation also expands the risks. A chatbot that makes a mistake while drafting text causes an annoyance; one that browses connected services can act on private information, purchases, bookings or corporate documents.

OpenAI acknowledges the danger of prompt injections, hidden messages or malicious pages designed to steer the agent away from its assigned task. The company has added dedicated defenses and requires confirmation for sensitive actions, but the problem does not disappear: a website may contain content that looks like useful information but is actually trying to manipulate the system.

The company has also activated ASL-3 safeguards, its enhanced framework for biological and chemical risks, after determining that the model has reached a high level of capability in that area. This is the first time OpenAI has publicly deployed these protections for a ChatGPT product.

For users and businesses, a sensible rollout starts with reversible tasks: researching, summarizing, preparing drafts, organizing data or creating a first version of a presentation. Operations involving money, permissions, sensitive information or irreversible decisions still require meaningful human review. ChatGPT Agent does not eliminate that oversight; it shifts it from every click to the definition and supervision of the task.

Turning the headline into a check

The first step is to freeze the system's identity. OpenAI introduced ChatGPT Agent with a virtual computer and tool use. A commercial name may cover different revisions, automatic routes and tools. A test record should preserve date, access mode, configuration, permissions and the full output. Without that snapshot, an improvement or failure observed today cannot rigorously be attributed to the version another person will use tomorrow.

Next, turn how to split an agent task into reading, proposal, approval and verifiable execution into cases with acceptance criteria. Build a local sample containing easy, ambiguous, long and deliberately impossible tasks. Record the input, the information the model may consult and what outcome would count as sufficient. A vendor-selected demonstration shows possibility; a test set preserved by the user measures reliability.

Autonomy needs a permission ladder. Reading and proposing are not the same as editing, sending or buying. A safer setup begins with read-only access, requires a preview and reserves execution for explicit approval. It also keeps a log and a rollback path. Judge the model by the errors the surrounding system contains, not by the confidence of its plan.

What the record must preserve

Cost and quality must be measured together. A cheap answer that must be reviewed from scratch can cost more than a slower but verifiable one. Measurement includes waiting, retries, consumption, human oversight and the consequences of failure. completing a demonstration does not remove errors, excessive permissions or irreversible actions. That boundary turns the announcement into a testable hypothesis rather than a promise to be believed.

An evidence sheet separates four columns: what the source claims, what it shows, what it did not measure and what would change the conclusion. That discipline prevents an absence from becoming a promise and a condition from vanishing in summary. It also lets the story be updated without rewriting history from a later outcome.

Include a negative case before deciding. Find a situation where the system, rule, transaction or study does not meet the need and record the signal that would require stopping. Selected successes show that something can happen; the negative case reveals the boundary and lowers the cost of discovering it after deployment.

The skill that outlasts the announcement

A valid comparison preserves denominator and axis. It does not pit a point figure against an average, future capacity against installed capacity or a forecast against an observation. When two sources use similar language, reconstruct what they counted and over what period. If those differ, publish them as different measures instead of inventing a ranking.

The record should survive a version change. Keep URL, consultation date, document, configuration and decision. When new evidence appears, add it with its date and explain what it changes. That traceability prevents opposite errors: keeping an expired conclusion or pretending later information was known on the event date.