What is OpenAI's Operator, and how does an AI use a web browser for you?

Yesterday, January 23, 2025, OpenAI released Operator, its first AI agent for the general public. An agent, in this sense, is an AI that does a job for you instead of only answering questions: you describe a task, and it carries out the steps on its own. Operator's workplace is the web. It opens a browser of its own, looks at each page and acts on it, much as you would.

Operator is labeled a research preview, meaning OpenAI expects mistakes and plans to change it based on feedback. For now it is available only to subscribers of ChatGPT Pro, the $200-a-month plan, in the United States, at operator.chatgpt.com.

What OpenAI released

OpenAI suggests everyday, repetitive jobs: filling out forms, ordering groceries, booking a table, buying tickets, even making memes. You type a request, a small window shows Operator's browser, and a running commentary explains what it is doing.

A few features help with repeated use:

• Custom instructions for all sites or a single one, such as your preferred airline on a travel site.
• Saved prompts on the home screen for jobs you repeat, like restocking groceries.
• Several tasks at once, each in its own conversation, the way you might keep several browser tabs open.

OpenAI says it is working with companies such as DoorDash, Instacart, OpenTable, Priceline, StubHub, Thumbtack and Uber so that Operator respects how their sites are meant to be used. The City of Stockton, California, is also testing it to help residents sign up for city services.

During the launch livestream, Sam Altman said other countries would get access soon, but that Europe will take longer. OpenAI also plans to bring Operator to its Plus, Team and Enterprise plans and, later, into ChatGPT itself.

How it works: see, think, act

Operator runs on a new model called Computer-Using Agent, or CUA. It combines the image understanding of GPT-4o with reasoning skills learned through reinforcement learning, a training method in which a model improves by trying tasks and being rewarded for good results.

Most software talks to websites through an API, a structured back door that programmers use. CUA does not need one. It works through the graphical user interface, the buttons, menus and text boxes people see. That is why it can, in principle, use almost any site.

OpenAI describes a loop that repeats until the job is done:

If something goes wrong, such as a pop-up or a wrong page, CUA can notice and correct course. If it is stuck, it hands control back to you.

OpenAI reports benchmark results, tests where an agent must complete set tasks. On OSWorld, which covers full computer tasks, CUA succeeds 38.1% of the time, against 22.0% for the previous best system and 72.4% for people. On WebArena, a set of simulated shopping and forum sites, it reaches 58.1% (humans score 78.2%), and on WebVoyager, which uses live sites like Amazon and GitHub, 87%. OpenAI notes that WebVoyager's tasks are mostly simple. In other words, the agent is useful but far from human reliability.

Safeguards and limits

Because an agent that can click buttons can also click the wrong ones, OpenAI built in several layers of control:

• Takeover mode. For logins, payment details and CAPTCHAs (the puzzles that check you are human), Operator asks you to take over. OpenAI says it does not record or screenshot what you type while you are in control.
• Confirmations. Before a significant action, such as submitting an order, it should ask for your approval.
• Refusals. It declines sensitive tasks such as banking transactions or high-stakes decisions like judging a job application.
• Watch mode. On sensitive sites, such as email, you must actively supervise it.
• Defenses against trick pages. A separate monitoring model watches for prompt injection, hidden text on a website that tries to give the agent instructions, and can pause the task.

OpenAI is frank about the limits. Operator struggles with complex interfaces such as building a slideshow or managing a calendar. TechCrunch adds that there are daily usage limits and that some actions, like deleting calendar events, are refused outright for now.

Why it matters

Until now, ChatGPT mostly produced text you then acted on yourself. Operator is OpenAI's first widely released attempt at the next step: AI that acts. Anthropic, Google and the start-up Rabbit have shown agents of their own, including Google's browser agent, Project Mariner, so this is a direction several labs are pursuing.

The open question is trust. A 38% success rate on full computer tasks is a big improvement and still well short of a person. The research-preview label, the $200 price and the US-only access all suggest OpenAI wants to learn from a small group before many people hand an AI their errands.

How do you give Operator a task safely?

Start with a low-stakes task where a mistake costs nothing, such as finding three campsites with availability on a given weekend, not booking one. Be specific: name the site, the dates, your budget and what "done" looks like. Ask Operator to stop and show you the result before any purchase.

Stay nearby while it works. Watch the browser window, take over for anything involving a password or a card, and read each confirmation request carefully before approving it. If you would not want an assistant to see a site, such as your bank, do not send Operator there.

Finally, review your privacy settings. OpenAI says that turning off "Improve the model for everyone" in ChatGPT also keeps Operator data out of training, and that a single click in Operator's privacy settings erases its browsing data and signs it out everywhere.