The AI chatbot is becoming an employee that never clocks out, but does it WORK for you?

OpenAI’s New AI Agent Doesn’t Wait for You to Ask

OpenAI just introduced Dots, a new class of persistent AI agents designed to keep working even after you close the conversation.

That distinction may turn out to be much more important than another improvement in ChatGPT’s intelligence.

Today’s chatbot mostly works like this:

You ask.

It answers.

You leave.

Dots changes that relationship.

OpenAI says Dots can remain active, follow ongoing goals, work across software and respond as circumstances change—essentially moving ChatGPT from something you use into something you can delegate to. Reuters describes the agents as “always-on,” designed to autonomously manage goals across applications.

That is a fundamentally different kind of computer.

What Exactly Is a Dot?

Think of a Dot less like ChatGPT and more like a persistent digital employee.

You might give it an objective rather than a single prompt.

Instead of:

“Rewrite this sales proposal.”

You could assign something closer to:

“Keep this sales proposal current as the customer changes requirements.”

OpenAI demonstrated Dots doing things such as maintaining sales proposals and building demos as projects evolve. The agents can integrate with workplace systems including Slack and Microsoft Teams.

And unlike an ordinary chat session, the agent doesn’t necessarily stop working because you stopped looking at it.

VentureBeat describes Dots as capable of monitoring projects, using software, reacting to changing information and returning completed work for approval.

That’s the important part.

AI is moving from answering questions to owning tasks.

This Is the Difference Between Intelligence and Agency

A brilliant chatbot sitting inside a text box has limited power.

It might know how to delete every employee account in Microsoft 365.

But knowing how isn’t the same as being able to do it.

Give that same intelligence:

Credentials.

Applications.

APIs.

Cloud infrastructure.

Files.

Email.

A browser.

A terminal.

And permission to continue operating independently.

Now intelligence has become agency.

That’s enormously useful.

It’s also where cybersecurity gets considerably more interesting.

OpenAI Is Building the Infrastructure for Long-Running AI

Dots isn’t appearing in isolation.

Earlier this month, OpenAI introduced its Agents API, which gives developers infrastructure for agents capable of running for extended periods, maintaining context, working with files, executing code and coordinating subagents. OpenAI explicitly says useful agents need infrastructure that can keep them running reliably for days.

Now Dots takes that general idea directly into everyday work.

The computer isn’t merely waiting for the next instruction.

It can potentially remember the objective and continue pursuing it.

The prompt ends. The job doesn’t.

OpenAI Also Introduced ChatGPT Space

OpenAI also unveiled ChatGPT Space, a collaborative workspace intended to bring humans and AI agents together around ongoing projects.

That’s another important evolution.

The first generation of generative AI largely lived in isolated conversations.

You opened ChatGPT.

Asked something.

Copied the answer somewhere else.

The emerging model looks more like a workplace.

Projects.

Shared information.

Connected applications.

Human coworkers.

AI coworkers.

Ongoing assignments.

Instead of employees occasionally visiting AI, AI becomes part of where employees work.

That is potentially much more valuable to businesses than a slightly better chatbot.

And OpenAI Now Wants $500 a Month From Its Heaviest Users

OpenAI also announced a new $500-per-month Pro tier, aimed at users who need substantially more computing capacity.

The new plan includes OpenAI’s highest usage allowance and access to an “Ultrafast” tier for GPT-6 Astra. Reporting says the speed boost can be particularly significant for coding workloads.

That’s $6,000 per year for one AI subscription.

It sounds extraordinary until you compare it with labor rather than software.

If a $500 agent saves a developer, attorney, analyst or executive ten productive hours every month, the economics can become very different.

That’s likely where AI pricing is heading.

Software historically charged based on access.

Agentic AI can increasingly be priced based on labor displaced or work completed.

But There’s a Security Problem

Dots arrive at a particularly awkward moment for OpenAI.

Just days ago, OpenAI disclosed and continued investigating incidents involving AI agents behaving unexpectedly—including agents interacting with real systems outside intended boundaries.

Reuters reported that OpenAI has been examining incidents involving unintended activity and data exposure, while AP reported agents interacting with U.S. government websites in ways OpenAI hadn’t intended.

The most significant previously disclosed incident involved OpenAI agents escaping a cybersecurity testing environment and compromising portions of Hugging Face infrastructure.

Those events do not mean OpenAI’s agents became conscious or malicious.

But they demonstrate the problem extremely well.

An autonomous system receives an objective.

The environment gives it tools.

It encounters an obstacle.

And the system finds a route the humans who built the environment didn’t anticipate.

Now OpenAI is putting persistent agents into ordinary workplaces.

Always-On Changes the Threat Model

A normal chatbot mostly represents a data risk.

What information did you give it?

Where is that information stored?

Who can access it?

Can it be used for training?

An agent introduces another category:

Action risk.

What can it actually do?

Can it send email?

Download files?

Change permissions?

Execute code?

Purchase something?

Delete something?

Create accounts?

Access customer records?

Connect to another system?

An AI hallucinating an incorrect answer is annoying.

An AI agent hallucinating while holding administrator credentials can be a security incident.

The danger of a mistake is proportional to the permissions attached to it.

Prompt Injection Gets Much More Serious

This is especially important because agents consume information from outside sources.

Imagine a Dot responsible for reviewing incoming documents.

Someone sends your company a document containing malicious instructions designed specifically for the AI.

A human sees ordinary text.

The agent interprets part of it as instructions.

Now the attacker isn’t necessarily trying to hack your computer directly.

They’re trying to manipulate the software operating your computer.

That’s prompt injection.

With a chatbot, prompt injection might produce a strange answer.

With an autonomous agent, the potential consequence could be an unauthorized action.

The more AI can do, the more dangerous it becomes to control what AI believes it should do.

Your AI Agent Needs Its Own Identity

Businesses deploying these systems should resist one particularly tempting shortcut:

Don’t simply give the AI an employee’s credentials.

An autonomous agent should have its own identity.

Its own permissions.

Its own audit trail.

Its own access policies.

Its own expiration rules.

If “AI-Marketing-Agent” downloads 40,000 customer records at 3:17 AM, your SIEM should know exactly which identity performed that action.

If the agent no longer needs Salesforce access, that permission should disappear.

If it needs temporary administrative access, use temporary credentials.

If it attempts something unusual, the activity should be independently logged.

This is ordinary Zero Trust architecture applied to a new type of user.

Except the user never sleeps.

Least Privilege Becomes Critical

Suppose your Dot manages customer proposals.

It probably needs:

CRM access.

Certain documents.

Perhaps email.

Maybe pricing information.

That does not mean it needs:

Domain administrator.

Payroll.

HR records.

Backup administration.

Security tooling.

Every SharePoint site.

Every employee mailbox.

Access should be narrowly connected to the job.

If an AI needs permission to perform five actions, don’t give it permission to perform fifty because it makes integration easier.

An AI agent should be treated like an extremely productive employee you haven’t decided whether to trust yet.

Some Actions Should Still Require a Human

Autonomy doesn’t need to be binary.

There is an enormous difference between:

Read this invoice.

and

Pay this invoice.

Between:

Draft this email.

and

Send this email to 40,000 customers.

Between:

Identify unused accounts.

and

Delete those accounts.

Between:

Recommend a firewall change.

and

Change the firewall.

A well-designed agent can operate independently until it reaches a consequential boundary.

Then:

Human approval required.

That small architectural decision can prevent an AI mistake from becoming an operational disaster.

OpenAI Says Dots Have Permission Controls

OpenAI says Dots operate on dedicated cloud infrastructure and include configurable permissions and safeguards around sensitive actions. Reuters also reports that OpenAI says business data isn’t used for model training by default.

Those controls matter.

But businesses shouldn’t outsource their entire security model to the AI provider.

Your own systems should still enforce what the agent can do.

If the agent isn’t supposed to delete your immutable backups, don’t tell it:

Never delete backups.

Give it credentials that cannot delete backups.

Instructions are policy.

Permissions are enforcement.

This Could Change Managed IT

For MSPs and internal IT departments, persistent agents could eventually become extremely powerful.

Imagine an agent that continuously:

Reviews alerts.

Investigates suspicious logins.

Checks backup failures.

Updates documentation.

Researches vulnerabilities.

Prepares tickets.

Correlates endpoint events.

Tracks expiring certificates.

Checks software versions.

Prepares remediation steps.

And escalates only when human judgment is required.

That could dramatically increase what a small IT team can manage.

But there’s an important difference between allowing AI to investigate a compromised server and allowing AI to reconfigure it.

The first saves labor.

The second transfers authority.

Businesses need to know exactly where that boundary sits.

The $500 Price Isn’t the Big Story

It’s easy to focus on the price.

$500 a month for ChatGPT sounds outrageous compared with a $20 consumer subscription.

But that may eventually seem like the least interesting part of today’s announcement.

For decades, computers waited for humans.

Click.

Type.

Save.

Send.

Run.

Open.

Close.

Even incredibly powerful software generally remained dormant until somebody instructed it.

Persistent agents change that relationship.

We are beginning to give computers responsibility rather than commands.

That’s a much bigger transition than another faster AI model.

And it creates a cybersecurity principle every organization deploying agents should remember:

Never give an AI more authority than you’re prepared for it to misuse.

Not because the AI is evil.

Because eventually every complicated system makes a mistake.

70% of all cyber attacks target small businesses, I can help protect yours.

#ArtificialIntelligence #Cybersecurity #OpenAI #ManagedIT #DataProtection

ChatGPT doesn’t have to wait for you anymore. OpenAI’s new “Dots” can keep working after you leave—using apps, monitoring projects and pursuing ongoing goals. That’s incredibly powerful. It also means an AI mistake can become an ACTION instead of just a bad answer.