OpenAI launches ChatGPT Agent to browse and complete tasks

OpenAI today launched ChatGPT Agent, a new feature that lets the chatbot complete complex tasks using its own virtual computer. The system can research the web, use connected apps, run code and prepare editable documents, all within the same conversation.

The new capability combines Operator’s ability to click and type on web pages with Deep Research’s ability to research and synthesize information. The result is a more ambitious product: it doesn’t just respond to a request, but can string together the steps needed to carry it through.

From answering questions to doing work

A user can ask it to review their calendar and prepare a report on upcoming meetings based on recent news, compare competitors and create a presentation, or update a spreadsheet with financial data while preserving its formatting.

To do this, ChatGPT Agent combines several tools. It has a visual browser that interacts with websites much as a person would; a text-based browser that is more efficient for locating and processing information; a terminal for running commands and code; and direct access to certain APIs. It can also connect to services such as Gmail or GitHub if the user authorizes it.

The key difference is that it maintains context across tools. It can locate a file on the web, download it, process it in the terminal and open the result in the browser. That continuity is what turns several standalone features into an agent: a system that plans a sequence of actions to achieve a goal.

When it needs to sign in to a website, the user takes control of the virtual browser to enter their credentials. OpenAI also says the agent asks for confirmation before taking consequential actions, such as making a purchase or sending something. The task can be interrupted, redirected or stopped at any time.

Available to paying subscribers

Agent mode is available starting today to ChatGPT Pro, Plus and Team users through the tools menu. Pro users get 400 agent messages per month; Plus and Team users get 40. OpenAI plans to bring it to Enterprise and Edu later this summer.

The message limits reveal that this is not an inexpensive feature to operate. Each request may involve browsing dozens of pages, running code and keeping a virtual computer active for minutes at a time. It also marks a difference from conventional ChatGPT: here, the unit of use is not a response but a potentially lengthy task.

Better benchmark results, but proceed with caution

OpenAI says the model powering the agent scores 41.6% on Humanity’s Last Exam, a test of expert-level questions across multiple disciplines. With up to eight parallel attempts and by selecting the answer the system reports as having the highest confidence, the score rises to 44.4%.

On FrontierMath, a set of novel and particularly difficult math problems, it scores 27.4% with access to tools such as the terminal. On BrowseComp, a test of finding information that is difficult to locate online, it reaches 68.9%—17.4 percentage points above Deep Research, according to the company.

One figure is especially relevant to office work: on SpreadsheetBench, which measures the editing of realistic spreadsheets, the agent scores 45.5% when it can edit the file directly. OpenAI compares that result with Copilot’s 20% in Excel, although the evaluation was run on macOS and LibreOffice, not the Windows and Excel environment used by the benchmark’s authors.

Benchmarks help measure progress, but they do not make the agent a reliable unsupervised employee. Many results come from OpenAI’s internal evaluations, and success on a benchmark task does not guarantee that a model will correctly interpret ambiguous instructions, changing data or business exceptions.

The problem with giving a model the power to act

ChatGPT Agent’s main innovation also expands the risks. A chatbot that makes a mistake while drafting text causes an annoyance; one that browses connected services can act on private information, purchases, bookings or corporate documents.

OpenAI acknowledges the danger of prompt injections, hidden messages or malicious pages designed to steer the agent away from its assigned task. The company has added dedicated defenses and requires confirmation for sensitive actions, but the problem does not disappear: a website may contain content that looks like useful information but is actually trying to manipulate the system.

The company has also activated ASL-3 safeguards, its enhanced framework for biological and chemical risks, after determining that the model has reached a high level of capability in that area. This is the first time OpenAI has publicly deployed these protections for a ChatGPT product.

For users and businesses, a sensible rollout starts with reversible tasks: researching, summarizing, preparing drafts, organizing data or creating a first version of a presentation. Operations involving money, permissions, sensitive information or irreversible decisions still require meaningful human review. ChatGPT Agent does not eliminate that oversight; it shifts it from every click to the definition and supervision of the task.