ChatGPT Work: what changes and what to check first

If you have opened ChatGPT in the last few weeks, you will have seen a new switch at the top of the screen: Chat on one side, Work on the other. It looks like an interface detail. It is not. On the other side of that switch sits a product with permissions the ordinary ChatGPT never had — and which most companies are about to turn on without knowing what they are turning on.

What it actually is

OpenAI announced ChatGPT Work on 9 July 2026. The promise is to move from “answers questions” to “delivers finished work”: the agent takes an objective, breaks it into steps and stays with it for hours on its own, producing documents, spreadsheets, presentations, reports and websites.

The first source of confusion is that “ChatGPT Work” is two products sharing one name. There is the one that runs in the cloud, reachable through chatgpt.com and the mobile apps; and the one that runs on your machine, inside the desktop application — the same app that until recently was called Codex and has now been folded into ChatGPT. One reaches what is in the cloud; the other reaches the files and programs on your computer. The name is the same; the consequences are not.

The rollout started with the Pro, Enterprise and Edu plans and then reached Plus and Business. Free accounts and the entry-level Go plan do not have access.

What it does that ordinary ChatGPT does not

This is where the difference stops being marketing. Work:

Connects to your systems. Gmail, Google Calendar, Google Drive, Slack and GitHub, through connectors. This is not you pasting text into a chat: it is the agent going in and reading.

Runs code with internet access. Ordinary ChatGPT executes code in a closed environment, with no package installs and no external API calls. Work goes out to the network — with a configurable domain allowlist, but open by default.

Has a full browser. An entire Chrome instance, able to open sites, fill in forms, take screenshots and run JavaScript against the page.

Keeps files between sessions. There is a working folder that persists, so something produced today is still there in tomorrow's conversation. In ordinary ChatGPT every conversation is an island.

Publishes websites. That is the feature we already covered in ChatGPT Sites, now part of the package.

Creates sub-agents and schedules tasks. It can spawn helper sessions and run instructions on a recurring schedule, with nobody at the screen.

What OpenAI promises — and on what evidence

The examples released at launch come from inside the company: a product manager said that organising a bug bash which would have taken at least 30 minutes happened automatically, and that analytical work that used to take three months now fits into a week. These are internal usage accounts, not independent measurement. They tell you the product's ambition; they are not a projection for your operation.

The risk almost nobody is covering

In late August, developer Simon Willison published a survey of what Work actually does — he had to reverse-engineer the product to arrive at 223 registered tools and 44 skills. His criticism is blunt: OpenAI explains Work in terms of what it is for, not what it does.

And the warning that matters most here is his too. Three elements, together, form a known security problem:

1. Access to private data. Your email, your calendar, your Drive, your Slack.

2. Exposure to untrusted content. An agent that browses the web and reads your inbox is constantly consuming text written by strangers.

3. A way to send data out. Code with open internet access, a browser that fills in forms, the ability to publish a website.

Each one on its own is manageable. All three in the same tool means an instruction hidden inside an email, a page or a document can become a command — and the exit route is already built. ChatGPT Work brings all three together by design, and so do its direct competitors: Anthropic's Claude Cowork and Microsoft's Copilot Cowork. This is not one product's flaw; it is the defining trait of a new category.

If that sounds theoretical, we have already covered real cases of agents doing what nobody asked — including what happens once you have more than one agent running at the same time.

The governance problem, which is more tedious than the security one

There is a practical consequence to documentation that describes purpose instead of capability: you cannot write a usage policy for a tool whose capabilities you cannot list. If your IT team cannot say whether the agent is able to send an email on the company's behalf, no internal rule about it is enforceable — it is just a document.

Six decisions before connecting

1. Choose what to connect, one thing at a time. Do not switch on Gmail, Drive, Slack and GitHub on the same day because the assistant suggested it. Every connector is a door, and every door needs a reason.

2. Do not use the owner's account. Connect a service account with access only to what that job requires. An administrator account is the worst place to experiment.

3. Start with reading. Summarising, finding, comparing, organising. Letting the agent send, publish or delete is a second phase, after you have seen how it gets things wrong.

4. Configure the domain allowlist. Internet access is adjustable. If the job does not need the open web, close it.

5. Check the plan before promising confidentiality. OpenAI states it does not train on business data or conversations in corporate accounts, and Enterprise offers zero data retention and an opt-out from training. A personal $20 Plus plan does not carry the same contractual guarantees — and that is exactly where most small companies are.

6. Write down who connected what. A sheet with the connector, the account used, the date and the person responsible. It looks like bureaucracy until the day someone has to unplug everything quickly.

The takeaway

ChatGPT Work is useful and the category is here to stay: three of the world's largest software vendors shipped the same thing within five months. The mistake is not adopting it; it is adopting it as if it were the old tool with one extra button. It has stopped being an assistant that answers and become an employee with keys to several doors. Hiring like that requires what any hire requires: start with minimum access, watch the work closely at first, and widen later.

If your company is at that point — wanting to use it, unsure where to draw the line — that is exactly what our AI implementation for business is for: deciding what to connect, with which account, with which permission and in which order, before the agent is inside everything.