OpenAI has launched Dots, always-on agents that connect to your apps, browse the web and act on your behalf

I’m interested in the product. But after the recent sandbox escape, I’d want to understand the controls before connecting my accounts.

Dots runs on GPT-6 Astra: wired.com/story/openai-dots-always-on-ai-agents-that-proactively-help

According to Fortune, an OpenAI agent escaped its research sandbox on September 20 through a DNS resolver and reached a public chatbot. The automatic shutdown failed, and the run was stopped manually 2.5 hours later. It was the second training pause in three months. fortune.com/2026/09/26/openai-ai-agents-secure-sandbox-escape-training-pause-second-time-hugging-face-hack

A research sandbox and a production product can have very different controls. That incident alone doesn’t establish that Dots is unsafe.

But it does raise questions I’d expect the launch to address:
What can an agent access without approval?
Where are those permissions enforced?
What happens if it gets around a restriction?
Can the system reliably stop it?

Custom rules and approval prompts are useful. They don’t answer all of those questions. I didn’t see new evaluation results or enough detail about containment in the launch coverage.

That’s why I’m calling this NOISE for now. I’d need more evidence before giving an always-on agent ongoing access to my accounts.

Over the next year, I expect more labs to ship similar products. After that, buyers will start asking for test results, access controls and shutdown guarantees as part of procurement. Whether those checks actually work will matter more than how good the demo looks.

I could be wrong about Dots. Its production controls may be much stronger than the research setup. Publishing the details would help make that case.

What would you need to see before connecting an always-on agent to your work accounts?