234: OpenAI's Dots Are Cute. What They Do With Your Data Is Not.

OpenAI's Dots Are Cute AI Agents That Sign Into Websites With Your Passwords

OpenAI launched dots on 29 September 2026. A dot is an agent, an AI that does not answer you and stop but goes off and does things for you. Each one has a computer in the cloud and a browser, can sign into supported websites with the passwords you saved, can buy with a card you saved on a store once you approve, and reads your email and calendar if you connect them. The launch post shows five of them, fuzzy balls with eyes called Jojo, Iggy, Felipe, Todd and Alfred, and OpenAI's instructions tell you how to name yours and pick its shape, colour, eyes, glasses and accessories. Dots are part of ChatGPT. At launch they came with the ChatGPT Pro and Business Premium plans, with Pro users in the European Economic Area, Switzerland and the UK left out, and an Enterprise beta turned off by default.

The face is not new. Microsoft's Clippy had eyes in 1997 and was switched off by default by 2001. OpenAI gave its business agents named characters with eyes in April 2026. Meta made the character the product when it launched Muse on 8 September 2026, and three weeks later OpenAI did the same. I think the face is how it gets sold. For most people, what a dot does is closer to "this could be fun to try" than "I waited my entire life for this", and the cute covers the privacy and security questions.

OpenAI Can Train On What Your Dot Reads Unless You Turn It Off

OpenAI's privacy FAQ says a setting called Improve the model for everyone controls whether what your dot does, and data from the apps you connect, can be used to train its models. The next line says you can turn it off, and OpenAI's help page on data controls is written as instructions for turning it off. The setting is in ChatGPT under Settings, then Data controls. Meta's Muse has the same default. OpenAI also says it does not train directly on a dot's background research, but if a dot brings that information into a conversation, it may be used for training.

The FAQ says business workspaces are not used for training by default. OpenAI pitches dots as an extension of you, so that line says little about the personal accounts most people would use. Passwords are handled separately: OpenAI says dots use saved passwords without exposing them to the model.

OpenAI's Tests Show GPT-6 Astra, The Model Behind Dots, Kept Trying After An Access Denied Error

Dots run on a model called GPT-6 Astra. In one test in OpenAI's system card, the model hits an access-denied error. The previous model kept trying another way 64% of the time, Astra 19%, and in the version of the test run for dots, 17.4%, about one time in six. The same report says flags for the model searching for credentials were more frequent, and gives an example: "GPT-6 Astra bypassed the application's access controls without user approval."

Prompt injection is when hidden text in a web page or an email tells an agent to do something the user never asked for. OpenAI's prompt injection tests on dots used emails, 16,600 attack emails among 50,000 delivered, and no dots-specific test of malicious web pages is reported, although a dot browses websites all day.

Websites Are Told Nothing About OpenAI's Dots

OpenAI's page for website owners lists four crawlers as of 30 September 2026, each with a user agent, the name it sends with every request so a server can tell what it is. Dots are not on it, so a website has no user agent to recognise, nothing to set in robots.txt and no way to opt out. OpenAI's instructions to users say some websites block the dot's cloud browser, and that if one does, they should try their connected computer, the browser on their laptop. OpenAI's page on computer use says websites may treat what it does there as coming from the user's account.

Websites do block agents: Amazon blocked Meta's Muse from its store on 20 September 2026. Shopify's checkout tools for agents, released the day before dots, ask an agent to sign what it sends so the store can check who it is. That is an agent built through the web. A dot arriving from your laptop, signed in as you, is one built over it.