OpenAI Launches Operator, an AI Agent That Browses for You
OpenAI unveils Operator, an agent that controls a web browser to book, shop and fill out forms on its own. It debuts in the US for Pro subscribers, with limits that show how far off real autonomy still is.
On 23 January 2025, OpenAI introduced Operator, an agent that used its own browser to complete tasks such as filling forms, ordering groceries and making reservations under supervision. It arrived as a research preview for US Pro users. ChatGPT Pro cost $200 a month; that subscription provided preview access, not unlimited autonomy or a guarantee of completing every workflow.
With this release, OpenAI is delivering on what CEO Sam Altman had promised earlier this year: that 2025 would be the year of agents, tools capable of automating tasks and acting on a user's behalf. Operator is the company's first concrete step in that direction.
What Operator does and how it works
Operator is available through operator.chatgpt.com, though OpenAI says it plans to eventually integrate it across all of its ChatGPT clients. The interface groups tasks into categories — shopping, delivery, dining, and travel — each enabling different kinds of automation.
When a user activates it, a small window pops up showing a dedicated web browser that the agent uses to complete the task, along with explanations of each action it takes. Because Operator runs its own browser, users can keep working on their screen while the agent operates in parallel.
Under the hood is Computer-Using Agent (CUA). It combines GPT-4o vision with reasoning learned through reinforcement learning, receiving screenshots and choosing mouse and keyboard actions. It can operate a graphical interface without a site-specific API. That universality has a cost: reading pixels and targeting coordinates is less reliable than operating on structured data.
In practice, that means the agent clicks buttons, navigates menus and fills out forms much the way a person would. That's a meaningful departure from other forms of automation: instead of relying on companies to open a technical door for it, Operator works through the same interface anyone would see.
OpenAI says it's collaborating with companies including DoorDash, eBay, Instacart, Priceline, StubHub and Uber to ensure Operator respects those businesses' terms of service.
A built-in handbrake
The most telling detail of the launch isn't what Operator can do on its own — it's what OpenAI won't let it do on its own. The CUA is trained to ask for user confirmation before finalizing tasks with real-world consequences, like placing an order or sending an email. The idea is to let a person review the model's work before it becomes irreversible.
OpenAI’s published product rule calls for confirmation before significant actions such as submitting an order or sending an email. This is not a formality: it separates reversible navigation from an external action that can spend money, communicate or alter an account.
Several different boundaries matter. Operator asks the person to take over for credentials, payment details and CAPTCHAs; OpenAI says it does not capture information entered during takeover. By contrast, the agent was trained to refuse sensitive tasks such as banking transactions or high-stakes decisions. On email and financial services, watch mode could require close supervision.
That caution limits how useful the tool is, but it also heads off the scenario the story practically writes itself around: the agent hallucinating and blowing your mortgage payment on accent chairs. It's a similar approach to the one Google took with its Project Mariner agent, which also won't fill in information like credit card numbers.
Where it still falls short
OpenAI did not hide that CUA was far from universally reliable. In its launch evaluations, it scored 38.1% success on OSWorld, 58.1% on WebArena and 87% on WebVoyager. These are different environments with different criteria, not a universal chance of success; the product page also warned about slideshows, complex calendars and non-standard interfaces.
On top of that, there are several practical limitations:
- Complex interfaces: a changing, non-standard or visually dense page can derail clicking or reading.
- Deliberate boundaries: it confirms external actions, refuses high-risk activity and requires supervision in sensitive domains.
- Takeover: credentials, payment details and CAPTCHAs return to the person; if the agent gets stuck, it must also yield the browser.
Why OpenAI is late to this game
The company has moved more slowly than its rivals in building an AI agent. Rabbit, Google and Anthropic had already unveiled their own takes, and the delay likely has something to do with the safety risks the technology carries.
The reason is obvious: once an AI system can act on the web, it opens the door to dangerous misuse. Bad actors could automate agents to orchestrate phishing scams or DDoS attacks, or to snap up concert tickets before anyone else has a chance. For a tool as widely used as ChatGPT, guarding against that kind of abuse matters enormously.
The Operator system card treats prompt injection as an open risk. On an internal set of 31 scenarios, mitigations reduced measured susceptibility from 62% to 23%; a separate monitor reached 99% recall and 90% precision across 77 red-team attempts. The same source warns that a laboratory result does not guarantee protection against novel attacks.
Still, OpenAI evidently believes Operator is safe enough to release in its current form, at least as a research preview.
The bigger picture: from Tasks to agents
Operator arrives just a week after OpenAI introduced Tasks, a feature that gives ChatGPT simple automation abilities — setting reminders and scheduling instructions to run at a fixed time each day. Tasks brought ChatGPT closer to familiar assistants like Siri or Alexa. Operator aims higher, showing off capabilities the previous generation of virtual assistants could never offer.
That's precisely the promise that's been sold around agents as the next big thing after ChatGPT: instead of simply delivering and processing information, agents could — in theory — take real action and actually get things done.
What to watch next
The rollout began as a research preview for Pro subscribers in the United States. In its 23 January announcement, OpenAI said it planned to expand Operator to Plus, Team and Enterprise and integrate its capabilities into ChatGPT once safety and usability could scale. It gave no dates for those expansions. A roadmap expresses intent; it is not guaranteed availability, geographic scope or timing. The page did not promise general access outside the United States either.
The initial conditions excluded anyone outside that access group, but the announcement does not support turning the absence into a specific European delay. For businesses, the interesting part is that Operator works on the web as it exists, without custom integrations — which vastly expands the number of services it can interact with, and also the number of ways it can get stuck.
With its first concrete bet on agents now on the table, it won't be long before we see just how realistic the vision the industry has been pitching for months really is. For now, the list of things Operator won't do — or will only do under supervision — says just as much about the state of the technology as the list of things it will.
This article was produced with artificial intelligence under human editorial oversight.
