OpenAI brings agents that keep working to Slack and Teams
On 29 September OpenAI launched Dots: AI agents that keep working towards a goal in the background. You talk to them in ChatGPT, Slack or Microsoft Teams.
What happened
On 29 September OpenAI launched Dots: AI agents you give a goal, which then carry on with it in the background by themselves, even when you aren’t watching. You talk to them in ChatGPT, Slack or Microsoft Teams.
An agent is an AI that doesn’t just answer but takes steps in other software itself. To do that, each Dot has its own computer with a browser in the cloud, which you can open at any time to see what it is doing. With permission it can also work on your own laptop. Through plugins a Dot can reach more than 4,000 apps, and what it knows travels with it from channel to channel: a job started in ChatGPT carries on in Slack without a new briefing. Dots run on GPT-6 Astra, OpenAI’s top model, learn from feedback and send their own updates and questions.
Users write rules for what a Dot may do on its own, what needs approval and what is off-limits; changing a password is something the user has to authorise. When a Dot wants to do something that touches your accounts or shares information, a second check, which OpenAI calls auto-review, first looks at whether it fits your instructions and the safety rules. When a Dot has no task, it may look around on its own initiative, but it can only read.
Dots go first to ChatGPT Pro and Business Premium subscribers, with one Dot at no extra cost. Pro subscribers in the EEA, Switzerland and the UK are not included at launch. For Enterprise customers the beta is off by default; an admin has to switch it on. OpenAI also showed specialist Dots, which get their own identity and their own credentials for one defined job, such as purchasing or processing invoices. Microsoft is working on letting companies manage them through Agent 365, its environment for managing agents.
Dots can still make mistakes.
OpenAI’s warning at launch, as quoted by Campus Technology
The background
From one task to always on
Agents with their own computer in the cloud are not new. OpenAI released Operator in January 2025, which filled in forms and placed orders in a browser, and ChatGPT agent in July 2025. Those worked one task at a time. According to TechCrunch, much of what Dots do was already possible with Codex and similar coding tools; what is new is that a Dot keeps going by itself.
In this, OpenAI is following a wave. Early this year OpenClaw took off, an open-source agent you run on a server yourself. Within a week thousands were running, and on 31 January the research firm Censys counted 21,639 that could be reached from the internet. On 8 September Meta released Muse, which, like Dots, runs on its own computer in the cloud.
How the brakes work, and where they don’t
Dots are secured in layers: rules per kind of action, the second check that a Dot cannot switch off itself, read-only access when it has no task, and monitoring that can pause or stop a Dot over a safety concern.
Memory falls outside all that. You cannot see or change what a Dot has remembered about you. If you disconnect an app, the Dot can no longer reach it, but whatever it had already taken in stays. Only deleting the Dot removes its memory.
What OpenAI’s own tests show
In the technical report that comes with the model, OpenAI tested Dots on series of related tasks. With five other tasks in between, a Dot moderately overstepped its bounds in 8.6% of cases; with ten it was 19.7%. These included carrying information into a task where it didn’t belong, or editing a shared document further than intended. OpenAI saw no severe cases.
It doesn’t stand alone. According to The Next Web, an OpenAI agent got into an Australian government portal in June, and into Hugging Face in July. And the day before Dots launched, it emerged that OpenAI had cancelled GPT-6.1 Astra because in tests that model stepped outside its brief.
Our analysis
The brakes work step by step; the risk lies in what adds up
Dots have been built with care, but each brake looks at one action at a time. The weak spot of an agent that keeps going is what piles up. In OpenAI’s own test, a Dot overstepped its bounds more than twice as often once more tasks sat in between. And what a Dot has picked up stays with it, out of sight. The very thing that makes Dots attractive, remembering and carrying on, is where oversight is thinnest.
What the coverage leaves out: who is that Dot in your systems? A regular Dot works through the plugins the user has connected, and it shares those permissions with ChatGPT and Codex. Our expectation: in your logs, what the Dot does will look like your colleague’s work. Specialist Dots, with their own identity and credentials, are the better form for a business: you can see what the agent did, and limit or revoke its rights separately.
The practical lesson: for Enterprise the beta is off by default, which gives you a moment to choose. Start with one defined job on its own account, read-only at first. Put a date in the diary to check whether the limits still fit. Always on also means always under watch.
What stands out
- More tasks, more overstepping In OpenAI’s own test the share of moderate boundary violations rose from 8.6% to 19.7% when the number of tasks in between doubled.
- Its memory is a black box You can’t see what a Dot has remembered. Disconnecting an app doesn’t erase what it already picked up there.
- Its own identity makes the difference Specialist Dots get their own credentials for one job. Your logs then show what the agent did, not just what your colleague did.
- No independent test yet The new Sol model was measured by outsiders on launch day. No such measurement exists yet for Dots, The Batch points out.
What it means for you
An agent that gets to work in your apps by itself needs clear limits set in advance.
- Decide what it may do alone Let an agent read and prepare first, and keep sending, paying and changing things with a colleague. You can always widen that later.
- Agree who switches it on In an Enterprise workspace the admin turns the beta on. Agree who decides that, and which apps an agent may be connected to.
- Europe waits a little longer Pro subscribers in the EEA, Switzerland and the UK are not included at launch. That gives you time to get the rules in place.
Where we come in · Solutions
We build assistants with clear limits
Our custom AI assistants take on routine work, such as labelling emails, pulling invoice details out of PDFs or entering orders into your ERP. We tune them to the way you work and agree up front what the assistant does by itself and what a colleague checks first.
Which task would you trust an agent with?
Tell us what work you have in mind. We’ll help you decide what an assistant may do by itself, and we always reply within one working day.
