In this guide · 8 sections
Short answer
ChatGPT agent mode has been folded into ChatGPT Work. It can research, compare suppliers, fill public web forms and turn files into reports, asking before it visits a new site or makes a commitment. Start with tasks on public websites and copies of files, not your email, bank or admin accounts.
What happened to ChatGPT agent mode
OpenAI launched ChatGPT agent in July 2025. It ran tasks in a virtual computer with its own browser, and asked you to take over for logins. In July 2026 OpenAI introduced ChatGPT Work, described in its release notes as an agent for longer, more involved tasks that can research, work across connected apps and files, and create finished documents, spreadsheets, presentations and reports. You can follow its progress, change direction and approve important actions.
Web tasks that agent mode used to do now run through Work's cloud browser. OpenAI also retired its separate Atlas browser in August 2026; our guide to AI browser agent security covers that change. If your account still shows the older agent option, the same safety rules below apply.
| Agent mode (2025) | ChatGPT Work (2026) | |
|---|---|---|
| How to start | Agent option in the tools menu | Choose Work in ChatGPT |
| Browsing | Virtual computer with a browser | Cloud browser, plus in-app browser on desktop |
| Files and apps | Connectors | Connected apps, plugins, local files on desktop with permission |
| Scheduled runs | Scheduled tasks | Scheduled Tasks, including triggers and monitoring |
| Usage | Monthly agent message limit | Shared usage with Codex |
Which ChatGPT plans include it
OpenAI's release notes say Work on web and mobile rolled out to paid plans except Free and Go, with Enterprise and Edu workspaces getting a preview period during which admins could opt out. OpenAI's Work and Codex pricing page lists Work in the Free, Go, Plus, Pro, Business, Edu and Enterprise plans, mainly through the desktop app on lower tiers, and says Work and Codex share the same usage limits.
- Plus: US$20 a month, per the same page, as of October 2026.
- Pro: plans from US$100 a month, with higher usage.
- Business, Enterprise and Edu: admins control whether Work, the cloud browser and connected apps are available. OpenAI says website sign-in through the cloud browser is not available in Enterprise or Edu workspaces.
For a small team, the practical point is that Work is already in most paid plans. The question is not whether to buy it, but which tasks to allow.
What ChatGPT Work can and can't do
OpenAI's ChatGPT Work overview describes the cloud browser as a remote browser that can navigate public websites, enter information into supported public forms, and combine information from an approved app with a website task.
Good fits
- Comparing supplier prices and terms on public sites
- Researching tender requirements and summarising them
- Turning a spreadsheet into a report or slides
- Filling a public enquiry or quote form with details you give it
- Monitoring a page for changes on a schedule
Poor fits or blocked
- Paying invoices or moving money
- Acting inside your email, bank or payroll without close supervision
- Tasks where an error is costly and hard to spot
- Sites behind CAPTCHAs or strict bot checks
- Anything needing a decision you have not written down
For budgeting beyond ChatGPT, see our guide to what AI agents cost a small business.
Approval prompts and what they protect
Per the Work overview, ChatGPT asks before visiting a new website by default. Users can choose Always ask, Auto approve (with automated risk checks) or Always allow, and allow or block individual sites. Admins can restrict those choices, for example by switching off Always allow for the whole workspace.
Allowing a site does not approve everything on it. OpenAI says ChatGPT can ask for a separate confirmation before actions that could create a financial, legal, account or other consequential commitment, such as submitting a booking or an order. You can also inspect page screenshots and a browser replay in the conversation.
Logged-in sites and prompt injection risks
The cloud browser runs separately from your own browser. OpenAI says it cannot access your local tabs, extensions, browsing history, saved passwords or signed-in sessions. That limits damage. But once you sign in to a site inside the cloud browser, or connect an app such as email or a drive, the agent can act with that access.
The main risk is prompt injection: instructions hidden in a web page, document or email that the agent reads and follows. It is first on the OWASP Top 10 for LLM applications, and "excessive agency" (an AI given more permissions than it needs) is sixth. Our explainer on prompt injection for businesses shows how these attacks work.
- Use connected apps with read-only access where the app offers it.
- Do not sign in to banking, payroll, domain registrar or admin consoles inside the agent.
- Give narrow instructions that name the site, the goal and what not to do.
- Check the result yourself before anything is sent, submitted or paid.
Three safe pilot tasks for a small business
Run each pilot two or three times and compare the output with what a person would have produced. Keep a note of time saved and errors found.
Supplier comparison from public websites
Ask Work to compare three named suppliers on price, delivery time and return terms, citing each page. Nothing is submitted and no login is needed.
Tender or grant requirements summary
Give it the public listing URL and ask for a checklist of documents, deadlines and eligibility points, with links back to each source line. Check every date against the original.
Monthly report from a copy of your data
Upload an exported spreadsheet, not a live connection, and ask for a one-page summary with charts. Compare totals with your accounting software.
Write down what you learned
Record which tasks worked, which needed heavy correction and which you will not allow. That becomes your AI use policy for staff.
Do it yourself or get help?
An owner can run the three pilots above in an afternoon on an existing Plus or Business plan.
Before staff use ChatGPT Work
If a task works well and repeats every week, it may be cheaper and more predictable as a fixed automation than as an agent run. Our Workflow Automation service (S$390 per workflow) builds those on Make, Zapier or Google Apps Script in your account. Security Awareness Training (S$390) covers safe AI use and prompt injection for staff.
Frequently asked questions
OpenAI introduced ChatGPT Work in July 2026 as its agent for longer, multi-step tasks, and web tasks now run through Work's cloud browser. Most users will find Work where agent mode used to be. Check OpenAI's help centre for your plan, because availability depends on plan, region, rollout and workspace settings.
It can fill supported public web forms and asks before visiting a new site. OpenAI says it can request a separate confirmation before consequential actions such as a booking or order. Review the details on screen before you confirm, and check the confirmation email afterwards rather than relying on the agent's summary.
Treat it with caution. Emails can contain hidden instructions that try to steer an AI agent, which is called prompt injection. Start with read-only access, narrow tasks such as summarising one thread, and no sending without your approval. Keep banking, payroll and admin consoles out of agent tasks.
Not in the cloud browser. OpenAI says the cloud browser runs separately from your local browser and cannot access local tabs, extensions, history, saved passwords or signed-in sessions. If you sign in to a site within the cloud browser, the agent can act with that session, so only sign in where the task needs it.
OpenAI's pricing docs list ChatGPT Work in Free, Go, Plus, Pro, Business, Edu and Enterprise plans, but on web and mobile it is limited to paid plans other than Go. Plus is US$20 a month as of October 2026. Usage is shared with Codex, so heavy use may need a higher plan or credits.