OpenAI has rolled out ChatGPT Work, and Simon Willison, as usual, took it apart piece by piece. This is not ChatGPT under a new name. It is a full platform for agents with some very interesting capabilities you need to know about if you build solutions on top of LLMs.
What sets Work apart from regular Chat?
- Open internet and a full Chrome. The most important part for me: Work can go online, clone repositories and install dependencies. And yes, it can run a full headless Chrome, fill in forms and take screenshots. That opens the door to automating tasks that need a real browser, not an emulation.
- File system access. Work has a persistent file system that survives between sessions and is even shared between running agents. This means agents can keep state, exchange data and work on shared projects, which is critical for complex pipelines.
- Sub-agents. Work lets you launch sub-agents, and that removes a lot of headaches when building complex agent systems. Scheduled prompts, as Willison found out, also work in regular ChatGPT.
- ChatGPT Sites. You can build and deploy entire websites on Cloudflare Workers, with databases and storage, straight from Work.
My first question when I see solutions like this: what about security? Simon Willison rightly points out that Work combines access to private data, exposure to untrusted content and the ability to exfiltrate information. That is exactly the "lethal trifecta" I keep talking about. You have to be extremely careful when working with a platform this powerful. For me, this does not cancel out the capabilities, but it adds one more hard control gate.
For those who build real agent pipelines and need deep automation, ChatGPT Work is a serious step forward. For those who just want a smarter chatbot, it is probably overkill. The first thing I will check: how it handles authentication and whether its access logic to external services leaks. Check your pipelines for where agents like this could fit in, but design a confirmation gate before any action an agent takes in the outside world, especially when it involves data access or executing transactions.
Who this is useful for:
- Practitioners and engineers building complex agent systems who need real automation with internet and file system access.
- Architects, to assess the new capabilities and security risks when integrating LLM solutions.
Who this is less relevant for:
- Users who just want a more advanced chatbot without deep automation.
Sources: https://simonwillison.net/2026/Aug/30/understanding-chatgpt-work/