Evaluation record · chatgpt-agent

ChatGPT Agent Mode

vAgent Mode v2 (2026)

OpenAI

Agentautonomousgeneral-purposecloud-agentconsumer

Adequate

About This Agent

Agent mode in ChatGPT that gives the assistant its own virtual computer, merging Operator's web browsing with deep research's analysis. Launched 2025-07-17; Agent Mode v2 (2026) adds persistent memory, scheduled tasks, and GitHub/Jira connectors. Runs in an isolated cloud VM with watch mode for sensitive sites and confirmations before consequential actions, while OpenAI openly acknowledges prompt injection as a core unsolved risk. Included in Plus, Pro, and Team plans with usage caps.

Last Evaluated: July 9, 2026

Official Website

Trust Vector Analysis

Dimension Breakdown

🚀Performance & Reliability

task completion accuracy

Benchmark claims weighed against independent hands-on reviews of end-to-end task completion

Evidence

OpenAI - Introducing ChatGPT agent — Launch model set state-of-the-art results on agentic benchmarks (Humanity's Last Exam, WebArena-class browsing tasks); independent reviews report real-world completion is slower and more variable on complex sites

4sysops - Testing ChatGPT Agent Mode — Independent testing found capable research-plus-action workflows but frequent stalls and confirmation friction on multi-site tasks

mediumVerified: 2026-07-09

tool use reliability

Review of the integrated browser/terminal/connector stack and its reliability across research-and-action workflows

Evidence

OpenAI Help Center - ChatGPT agent — Integrated toolset: visual browser, text browser, terminal with limited network access for code/data/slides, file handling, and first-party connectors (Google Drive, Gmail, GitHub, Jira)

mediumVerified: 2026-07-09

multi step planning

Evaluation of long-horizon research-then-act task execution and interruption/resume behavior

Evidence

OpenAI - Introducing ChatGPT agent — Fluidly shifts between reasoning and action to handle complex workflows start to finish — the explicit design goal of merging Operator and deep research

mediumVerified: 2026-07-09

memory persistence

Review of v2 persistent memory, ChatGPT memory integration, and scheduled-task state handling

Evidence

OpenAI Help Center - ChatGPT release notes — Agent Mode v2 (2026) adds persistent memory across agent sessions plus rebuilt scheduled tasks (dedicated Scheduled page, connector access from scheduled runs)

mediumVerified: 2026-07-09

error recovery

Assessment of retry behavior and failure modes reported in independent testing

Evidence

4sysops - Testing ChatGPT Agent Mode — Retries and re-plans after failed page interactions, but reviewers report loops on CAPTCHA/anti-bot walls and occasional abandoned tasks

lowVerified: 2026-07-09

agent collaboration

Review of multi-agent composition capabilities versus peers with native sub-agents

Evidence

OpenAI Help Center - ChatGPT agent — Single-agent design with no user-facing sub-agent composition; delegation exists only via separate scheduled tasks and connectors

lowVerified: 2026-07-09

🛡️Security

tool sandboxing

Architecture review of the cloud VM isolation model and restricted terminal network egress

Evidence

OpenAI - Introducing ChatGPT agent — All execution happens on OpenAI's own virtual computer in the cloud — browser, terminal with limited network access, and file tools never touch the user's device

highVerified: 2026-07-09

access control

Review of confirmation gates, takeover-mode credential handling, and admin controls on connectors

Evidence

ChatGPT agent System Card — Explicit user confirmation required before consequential actions (purchases, sending email, editing files); takeover mode lets users enter credentials themselves without the model seeing or storing them; connectors use scoped OAuth subject to workspace admin enablement

mediumVerified: 2026-07-09

prompt injection defense

Review of documented mitigations and OpenAI's own risk framing; credit for layered defenses and candor, discounted for the acknowledged unsolved core risk across an open-web action surface

Evidence

ChatGPT agent System Card — Layered mitigations: injection-focused fine-tuning, automated monitors that detect and block injection patterns, watch mode requiring active user supervision on sensitive sites (email, banking) that pauses when the user goes inactive, plus internal and external red teaming

OpenAI - Understanding prompt injections — OpenAI publicly frames prompt injection as a frontier security challenge for its agents that may never be fully solved, committing to continuous adversarial training rather than claiming a fix

mediumVerified: 2026-07-09

data isolation

Review of session isolation, takeover-mode data handling, and browsing-data deletion controls

Evidence

OpenAI Help Center - ChatGPT agent — Per-task virtual computer sessions; takeover-mode inputs (e.g., passwords) are not collected or stored; browsing data deletable by the user

mediumVerified: 2026-07-09

open source transparency

Source availability assessment; credit for the published system card and safety documentation

Evidence

ChatGPT agent System Card — Closed-source product; OpenAI published a detailed system card and a dedicated deployment-safety hub documenting watch mode and mitigations

highVerified: 2026-07-09

🔒Privacy & Compliance

data retention

Review of retention and training-use policies across consumer and workspace tiers as applied to agent sessions

Evidence

OpenAI Help Center - ChatGPT agent — Agent sessions follow ChatGPT retention: consumer chats retained unless deleted with training opt-out available; Business/Enterprise excluded from training by default; users can clear agent browsing data

mediumVerified: 2026-07-09

gdpr compliance

Compliance certification and DPA availability review under the OpenAI umbrella

Evidence

OpenAI Trust Portal — SOC 2 Type 2 attestation and GDPR-aligned DPA available for Business/Enterprise workspaces; agent mode inherits these commitments

mediumVerified: 2026-07-09

third party data sharing

Data flow analysis of connector and authenticated-browsing traffic

Evidence

OpenAI Help Center - ChatGPT agent — Connectors (Gmail, Google Drive, GitHub, Jira, Slack) and logged-in browsing move data between the agent VM and third-party services; each is user/admin opt-in but broadens flows well beyond OpenAI

mediumVerified: 2026-07-09

local deployment option

Deployment options assessment

Evidence

OpenAI - Introducing ChatGPT agent — Cloud-only: the virtual computer runs exclusively in OpenAI's infrastructure with no self-hosted, on-premises, or offline option

highVerified: 2026-07-09

👁️Trust & Transparency

documentation quality

Documentation completeness review across help center, system card, and safety hub

Evidence

OpenAI Deployment Safety Hub - ChatGPT agent — Help center articles, release notes, a full system card, and a deployment-safety hub documenting watch mode, confirmations, and known risks

highVerified: 2026-07-09

execution traceability

Review of live session visibility, interruption controls, and workspace audit exports

Evidence

OpenAI - Introducing ChatGPT agent — Users watch the agent's virtual browser and step narration live, can interrupt or take over at any point; Team plans in v2 add audit log export for scheduled tasks

mediumVerified: 2026-07-09

decision explainability

Assessment of plan narration and pre-action confirmation clarity

Evidence

OpenAI Help Center - ChatGPT agent — Narrates plans and progress and asks before consequential actions, though model/tool selection inside the VM is opaque

mediumVerified: 2026-07-09

open source code

Open source assessment

Evidence

OpenAI - Introducing ChatGPT agent — Fully proprietary agent model and infrastructure; no source availability

highVerified: 2026-07-09

community activity

Community engagement analysis via user base scale, release cadence, and public discussion

Evidence

OpenAI Help Center - ChatGPT release notes — Deployed to ChatGPT's massive paid user base with steady feature releases (v2 memory, scheduled tasks, connectors) and extensive third-party coverage and testing

highVerified: 2026-07-09

⚙️Operational Excellence

ease of integration

Onboarding friction assessment for existing ChatGPT subscribers

Evidence

OpenAI Help Center - ChatGPT agent — Zero setup: select agent mode from the tools dropdown in any ChatGPT conversation; connectors configured with a few clicks

highVerified: 2026-07-09

scalability

Assessment of usage caps, credit top-ups, and scheduled-task limits across tiers

Evidence

OpenAI Help Center - ChatGPT agent — Monthly message caps (roughly 400 for Pro, 40 for Plus/Team at launch, with credit-based top-ups); v2 scheduled tasks capped at 25/month for Plus, unlimited on Team

mediumVerified: 2026-07-09

cost predictability

Pricing model analysis of subscription-included usage versus optional credit purchases

Evidence

OpenAI Help Center - ChatGPT agent — Included in Plus ($20/mo), Pro ($200/mo), and Team subscriptions — flat pricing with hard caps; optional credits are the only variable spend

highVerified: 2026-07-09

monitoring capabilities

Monitoring and admin tooling review across consumer and workspace tiers

Evidence

OpenAI Help Center - ChatGPT Business release notes — Workspace admins control connector enablement and get audit log export for scheduled agent tasks; per-session visibility for consumers, but no organization-wide agent observability comparable to enterprise agent platforms

mediumVerified: 2026-07-09

production readiness

Maturity assessment from GA timeline, scale of deployment, and iteration history

Evidence

OpenAI - Introducing ChatGPT agent — Generally available to paid tiers since 2025-07-17 — nearly a year in production at ChatGPT scale, with a v2 iteration in 2026

highVerified: 2026-07-09

Strengths

+Clean isolation model: everything executes in OpenAI's cloud virtual computer, never on the user's device
+Layered, honestly-documented safety: confirmations before consequential actions, watch mode on sensitive sites, injection-trained models and monitors
+Takeover mode keeps passwords out of the model entirely
+Merged Operator + deep research design handles research-then-act workflows end to end
+Agent Mode v2 (2026) added persistent memory, rebuilt scheduled tasks, and GitHub/Jira connectors
+Included in existing Plus/Pro/Team subscriptions with flat pricing
+Published system card with internal and external red teaming

Limitations

!OpenAI itself states prompt injection may never be fully solved; the open-web action surface makes this the defining risk
!Consumer-grade governance: no org-wide agent observability, limited admin controls outside Business/Enterprise
!Tight usage caps (roughly 40 messages/month on Plus/Team) constrain real workloads
!Real-world execution is slow and brittle on complex or bot-protected sites
!Cloud-only with no self-hosted option; connectors extend data flows to many third parties
!Single-agent design without sub-agent delegation
!Closed source with opaque internal tool/model routing

Metadata

license: Proprietary

supported models

0: Dedicated agentic model (o3 family at launch; updated with GPT-5.x generation in 2026)

deployment type: Cloud-only (per-task virtual computer in OpenAI infrastructure)

tool support

0: Visual browser (GUI interaction)

1: Text browser

2: Terminal with limited network access

3: File generation (slides, spreadsheets, documents)

4: Connectors: Google Drive, Gmail, GitHub, Jira, Slack (v2)

5: Scheduled tasks

first release: 2025-07-17 (merger of Operator and deep research); Agent Mode v2 in 2026

pricing: Included in ChatGPT Plus ($20/mo), Pro ($200/mo), and Team; ~400 messages/mo Pro, ~40 Plus/Team, credit top-ups available

Use Case Ratings

research assistant

Strongest fit: deep research heritage plus the ability to act on findings — logging in, refining results, and producing reports, slides, and spreadsheets

data analysis

Terminal in the VM runs code for analysis and generates spreadsheets/slides, though without a persistent data environment

content creation

Produces editable slides and documents from research; formatting fidelity still trails specialist tools

code generation

Can run code and use the v2 GitHub connector, but lacks repository workflows — OpenAI's Codex is the intended coding agent

Similar Agents

OpenAI Codex

OpenAI

Claude Cowork

Anthropic

Microsoft Scout

Microsoft

Manus

Butterfly Effect / Meta (acquisition being unwound as of June 2026)