Summary
- ChatGPT Work (cloud version) gives paid subscribers code execution with unrestricted internet access, a headless Chrome browser, and a persistent shared filesystem — capabilities well beyond regular ChatGPT Chat.
- All three components of the ‘lethal trifecta’ risk model are present: access to private data, exposure to untrusted content, and the ability to exfiltrate information.
- OpenAI has not publicly documented how ChatGPT Work sessions are protected against prompt injection attacks.
- The product is available to subscribers at the $20/month tier and above; free and $8/month users are excluded.
- A researcher enumerated 223 registered tools and 44 skills inside the product — including browser automation, document creation, spreadsheet manipulation, and site deployment — by prompting the agent itself.
What ChatGPT Work actually is
OpenAI launched ChatGPT Work on 9 July and has been updating it continuously since. Researcher Simon Willison, who has spent considerable time working through its capabilities, describes it as ‘an extraordinarily confusing and very powerful product’. It is worth being precise about what we are discussing: there are two distinct variants. One runs in the cloud via the ChatGPT web interface and mobile apps; the other is a desktop application. This article is concerned with the cloud version, which carries the more significant organisational risk profile.
Capabilities that distinguish it from regular Chat
ChatGPT Work is not simply a rebranded chat interface. It adds several capabilities that are absent from the standard Chat product. These include a code execution environment with open internet access, a full headless Chrome browser instance that can load pages, fill forms, run JavaScript against the DOM, and take screenshots, and a persistent filesystem that is shared across sessions. Where Chat sessions each receive an isolated, temporary workspace, Work sessions write to folders that persist and — according to Willison’s testing — appear to be simultaneously accessible to all concurrently running Work sessions.
The internet-connected code execution environment
The code execution capability is notable because it removes a constraint that previously applied to ChatGPT’s sandboxed environment. In regular Chat, attempts to install additional software packages or interact with external APIs are blocked by a container proxy. ChatGPT Work, by contrast, defaults to allowing outbound connections to all domains, though administrators can configure a specific allowlist. This means the agent can clone repositories from GitHub, install dependencies, and interact with arbitrary web services — all within a single prompted session.
Browser automation raises its own concerns
The headless browser tool allows the agent to navigate websites, interact with forms, and execute arbitrary JavaScript against loaded pages. Willison notes that if a site requires authentication, the browser can pause and prompt the user to enter credentials and multi-factor codes directly, without those values passing through the underlying model. That is a reasonable design choice, but it does not address what happens when the agent browses to content it was not originally directed to — content that could contain instructions intended to redirect its behaviour.
The prompt injection question
Willison applies what he calls the ‘lethal trifecta’ framework to assess agentic systems: the combination of access to private data, exposure to untrusted external content, and a channel through which data could be sent to an attacker. ChatGPT Work satisfies all three conditions. He notes that he would welcome more detail from OpenAI about how the product is protected against prompt injection, and that he expects their answer involves the same automated review mechanism used in Codex. As of publication, OpenAI has not publicly addressed this.
Scale of the tool surface
To understand the full scope of what the agent can do, Willison prompted a Work session to enumerate its own capabilities. The result was a reference site listing 223 registered tools and 44 skills. These include document and PDF handling, spreadsheet manipulation, image generation, data dashboard construction, and the ability to build and deploy websites via Cloudflare Workers. The breadth of this surface is relevant to anyone assessing what an attacker — or an inadvertently misdirected agent — could accomplish within a single session.
Access and availability
ChatGPT Work is currently restricted to subscribers at the $20 per month tier and above. Free users and those on the $8 per month Go tier do not have access. This limits immediate exposure to paying enterprise and professional subscribers, but organisations that provide staff with ChatGPT subscriptions at that tier should assume the capability is in use.
Why it matters
ChatGPT Work represents a meaningful shift in what a standard AI subscription can do inside an organisation. The combination of persistent shared storage, open internet access, and browser automation means that a single misdirected or manipulated session has the technical reach to exfiltrate files, interact with internal systems reachable from the user’s browser context, and communicate with external infrastructure. The absence of published documentation on prompt injection controls means security teams are currently unable to verify what guardrails exist. CISOs should establish whether staff are using this product, under what conditions, and whether acceptable use policies address agentic AI tools specifically.
What to do now
- Determine whether any staff hold ChatGPT subscriptions at the $20/month tier or above, and therefore have access to ChatGPT Work.
- Review and update acceptable use policies to specifically address agentic AI tools that can access the internet, execute code, and persist data across sessions.
- Assess whether sensitive data could be accessible to ChatGPT Work sessions via the user’s browser context or filesystem, particularly for staff who use the desktop application.
- Monitor OpenAI’s documentation and security communications for any published detail on prompt injection protections within ChatGPT Work.
- Consider whether organisational network controls should restrict or log traffic to chatgpt.com endpoints associated with agentic sessions until the security posture is better understood.
