What is ChatGPT agent, and how does it do tasks on its own computer?

Yesterday, July 17, 2025, OpenAI introduced ChatGPT agent. Until now, ChatGPT mostly answered: you asked, it wrote. With agent mode, you can hand it a job, such as "look at my calendar and brief me on next week's client meetings," and it works through the steps itself, opening websites, clicking, running code and producing a finished file.

An agent, in AI, is a system that pursues a goal by choosing and using tools over several steps, instead of replying once. OpenAI has offered pieces of this before. ChatGPT agent puts them together in the place most people already use.

What OpenAI released

OpenAI describes ChatGPT agent as one system that joins three things:

• Operator, its research preview that could scroll, click and type on websites;
• deep research, which reads many sources and writes a detailed report;
• ChatGPT's ordinary conversation skills.

The two earlier tools had opposite gaps. Operator could act on websites but could not analyze deeply or write long reports. Deep research could analyze but could not interact with sites or reach pages behind a login. OpenAI says many Operator requests were really research tasks, so it merged the two.

You switch it on from the tools menu in the message box by choosing agent mode, at any point in a conversation. As it works, an on-screen narration shows what it is doing.

The separate Operator site will stay up for a few more weeks before it closes. The original deep research option remains in the menu for people who want its longer reports.

How the virtual computer works

The key idea is that ChatGPT gets its own computer: a virtual machine, meaning a computer simulated on OpenAI's servers, that keeps track of the task as it switches tools. On it, the agent has:

• a visual browser that sees and clicks web pages the way a person does;
• a text browser that reads pages quickly as plain text;
• a terminal, a command line where it can run code and handle files;
• API access, direct connections to some services;
• connectors, links you set up to apps like Gmail or GitHub so it can look up your own information.

It chooses whichever path fits the step. It might read your calendar through a connector, skim dozens of pages with the text browser, download a spreadsheet, process it in the terminal, then check the result in the visual browser.

Here is how a request might unfold:

Find three Italian restaurants near my office that can seat eight people
next Friday at 7 p.m. Compare price, reviews and distance in a table,
then wait for me to pick one before booking anything.

1. The agent searches the web with the text browser and makes a shortlist.
2. It opens each restaurant's booking page in the visual browser to check availability.
3. It builds the comparison table and shows it to you.
4. It stops and asks for your choice. If a booking needs your account, it asks you to take over the browser and log in yourself.

You can interrupt at any time to change the instructions, and it continues without losing its progress. If the job takes a while, the phone app can notify you when it is done. Finished tasks can also be scheduled to repeat, for example a report every Monday.

OpenAI reports that the model behind the agent scores 41.6% on Humanity's Last Exam, a set of expert-level questions, and 68.9% on BrowseComp, a test of finding hard-to-locate facts online. TechCrunch notes that earlier agents have often been brittle on real websites, so everyday results remain to be seen.

The risks, and the safeguards

This is the first time ChatGPT can take actions on the web for its users, and OpenAI says that raises its overall risk. The main new danger is prompt injection: instructions hidden in a web page, for instance in invisible text, that try to trick the agent into doing something you did not ask, like sending your private data elsewhere.

OpenAI's protections include:

• asking for explicit permission before actions with real consequences, such as a purchase;
• a watch mode that requires your active supervision for sensitive tasks such as sending email;
• refusing high-risk tasks such as bank transfers;
• a takeover mode where you type passwords yourself and the model does not see them;
• a setting to delete browsing data and log out of all sites in one click.

TechCrunch adds that OpenAI turned off ChatGPT's memory feature for the agent, to reduce the chance that an attack extracts personal information. OpenAI is also treating the agent as highly capable in biology and chemistry under its Preparedness Framework, its internal rulebook for serious risks, as a precaution, with extra monitoring of related requests.

OpenAI is candid that the agent is early. It can make mistakes, and slide creation is labeled beta: slides can look plain and may not always match when exported to PowerPoint.

How do you give ChatGPT agent its first task safely?

Start with a task where a mistake costs little: research and comparison, not purchases. Choose agent mode in the tools menu, then describe the goal, the limits and the moment you want it to pause. "Do not buy or send anything; show me the result first" is a useful sentence to include.

Connect only the apps the task needs, and turn connectors off when you are done; OpenAI itself suggests this to reduce exposure. When a site needs a login, use takeover mode and type your password yourself. Watch the narration during the first few runs, and stop the task if it heads somewhere you did not intend.

Finally, check the output as you would a new assistant's work. Open the links it used, verify numbers in its tables, and only then let it take the final step. As you learn where it is reliable, you can hand it longer tasks.