OpenAI Launches Operator, an AI Agent That Browses for You

OpenAI unveiled Operator on Thursday, its first AI agent capable of taking control of a web browser and carrying out tasks independently: booking travel, ordering from restaurants, or shopping online. It arrives as a research preview — a public test version that OpenAI openly describes as unfinished — and launches first in the United States for subscribers to ChatGPT's $200-a-month Pro plan.

With this release, OpenAI is delivering on what CEO Sam Altman had promised earlier this year: that 2025 would be the year of agents, tools capable of automating tasks and acting on a user's behalf. Operator is the company's first concrete step in that direction.

What Operator does and how it works

Operator is available through operator.chatgpt.com, though OpenAI says it plans to eventually integrate it across all of its ChatGPT clients. The interface groups tasks into categories — shopping, delivery, dining, and travel — each enabling different kinds of automation.

When a user activates it, a small window pops up showing a dedicated web browser that the agent uses to complete the task, along with explanations of each action it takes. Because Operator runs its own browser, users can keep working on their screen while the agent operates in parallel.

Under the hood is a model OpenAI calls a Computer-Using Agent, or CUA. According to the company, it combines the vision capabilities of GPT-4o with the reasoning abilities of OpenAI's more advanced models. The key technical detail is that the CUA is trained to interact with the front end of websites, meaning it doesn't need developer-facing APIs to tap into different services.

In practice, that means the agent clicks buttons, navigates menus and fills out forms much the way a person would. That's a meaningful departure from other forms of automation: instead of relying on companies to open a technical door for it, Operator works through the same interface anyone would see.

OpenAI says it's collaborating with companies including DoorDash, eBay, Instacart, Priceline, StubHub and Uber to ensure Operator respects those businesses' terms of service.

A built-in handbrake

The most telling detail of the launch isn't what Operator can do on its own — it's what OpenAI won't let it do on its own. The CUA is trained to ask for user confirmation before finalizing tasks with real-world consequences, like placing an order or sending an email. The idea is to let a person review the model's work before it becomes irreversible.

"The CUA model is trained to ask for user confirmation before finalizing tasks with external side effects, for example before submitting an order, sending an email, etc., so that the user can double-check the model's work before it becomes permanent," OpenAI writes in materials provided to TechCrunch.

Some tasks require mandatory oversight. For banking transactions, for instance, users have to step in themselves to enter credit card details. OpenAI says Operator doesn't collect or screenshot that data. And on especially sensitive sites, such as email, the agent requires active supervision so users can catch and fix any mistakes.

That caution limits how useful the tool is, but it also heads off the scenario the story practically writes itself around: the agent hallucinating and blowing your mortgage payment on accent chairs. It's a similar approach to the one Google took with its Project Mariner agent, which also won't fill in information like credit card numbers.

Where it still falls short

OpenAI isn't hiding the fact that the CUA is far from reliable. "We don't expect the CUA to perform reliably in all scenarios just yet," the company acknowledges, adding in a support document that Operator "cannot reliably handle many complex or specialized tasks, such as creating detailed slideshows, managing intricate calendar systems, or interacting with highly customized or non-standard web interfaces."

On top of that, there are several practical limitations:

• Usage caps: there are daily and per-task limits. Operator can run multiple tasks at once, but under "dynamic limits," and there's an overall usage cap that resets every day.
• Tasks it refuses outright: at this stage, the agent will flatly refuse to send emails — even though the CUA is technically capable of it — or delete calendar events, for security reasons. OpenAI says that will change, but hasn't given a timeline.
• Getting stuck: if it runs into a particularly complex interface, a password field or a CAPTCHA, Operator can get stuck and ask the user to take over.

Why OpenAI is late to this game

The company has moved more slowly than its rivals in building an AI agent. Rabbit, Google and Anthropic had already unveiled their own takes, and the delay likely has something to do with the safety risks the technology carries.

The reason is obvious: once an AI system can act on the web, it opens the door to dangerous misuse. Bad actors could automate agents to orchestrate phishing scams or DDoS attacks, or to snap up concert tickets before anyone else has a chance. For a tool as widely used as ChatGPT, guarding against that kind of abuse matters enormously.

OpenAI says it has built in safeguards: "Operator employs tools that seek to limit the model's susceptibility to malicious prompts, hidden instructions, and phishing attempts," the company explains on its website. "A monitoring system pauses execution if suspicious activity is detected, while automated and human-reviewed pipelines continuously update safeguards."

Still, OpenAI evidently believes Operator is safe enough to release in its current form, at least as a research preview.

The bigger picture: from Tasks to agents

Operator arrives just a week after OpenAI introduced Tasks, a feature that gives ChatGPT simple automation abilities — setting reminders and scheduling instructions to run at a fixed time each day. Tasks brought ChatGPT closer to familiar assistants like Siri or Alexa. Operator aims higher, showing off capabilities the previous generation of virtual assistants could never offer.

That's precisely the promise that's been sold around agents as the next big thing after ChatGPT: instead of simply delivering and processing information, agents could — in theory — take real action and actually get things done.

What to watch next

The rollout will be gradual. OpenAI says it plans to bring the feature to more users on its Plus, Team and Enterprise plans over time. Outside the US, Altman was blunt during Thursday's livestream: it's coming to other countries soon, but "Europe will, unfortunately, take a while."

That open-ended delay for Europe leaves the continent's audience waiting while the rest of the market puts the tool through its paces and finds its flaws. For businesses, the interesting part is that Operator works on the web as it exists, without custom integrations — which vastly expands the number of services it can interact with, and also the number of ways it can get stuck.

With its first concrete bet on agents now on the table, it won't be long before we see just how realistic the vision the industry has been pitching for months really is. For now, the list of things Operator won't do — or will only do under supervision — says just as much about the state of the technology as the list of things it will.