ChatGPT agent puts a supervised browser and editable artifacts inside the chat composer

The entry point is a dropdown, not a separate product

OpenAI didn't ship agent capabilities as a new app. Pro, Plus, and Team users activate them through the tools dropdown in the composer by selecting 'agent mode' at any point in any conversation. The company frames this explicitly: you can 'naturally transition from a simple conversation to requesting actions directly within the same chat.'

That decision folds two previously distinct surfaces — Operator's web interaction and deep research's synthesis — into the ordinary chat flow. OpenAI is sunsetting the Operator research preview site 'a few more weeks' after launch, and deep research now lives inside agent as a dropdown option for users who want its longer, more detailed runs. The frontend consolidation is the product story as much as the unified model underneath it.

Narration, takeover, and interruption as the trust interface

Because the agent acts on a live web with a user's data, OpenAI built the interface around visibility and intervention rather than a black box. As the agent works, 'an on-screen narration provides visibility into exactly what ChatGPT is doing.' Users can interrupt at any point to clarify instructions, steer the outcome, or change the task entirely, and the agent 'will pick up where it left off... without losing previous progress.'

The source describes graduated controls tied to consequence. Explicit confirmation is required before real-world actions like purchases. Certain critical tasks such as sending emails require active oversight through a 'Watch Mode.' High-risk actions like bank transfers are refused outright. And for authenticated sites, the model prompts you to log in via browser takeover.

That takeover mode carries a specific privacy design: 'ChatGPT does not collect or store any data you enter during these sessions, such as passwords, because the model doesn't need it, and it's safer if it never sees it.' The interface deliberately routes credentials around the model rather than through it.

Editable artifacts are the output surface — and the roughest edge

The agent delivers work as editable slideshows and spreadsheets, not just chat text. Slides export with 'text, charts, images, and shapes that are natively and easily editable after export,' and the source lists concrete uses like converting dashboards into editable vector presentations and updating spreadsheets while retaining formatting.

OpenAI is candid that this surface is unfinished. Slideshow generation is in beta; outputs 'can sometimes feel rudimentary in its formatting and polish,' and there are 'occasional discrepancies between the slides in the viewer and the exported powerpoint.' You can upload a spreadsheet as a template but not yet a slideshow. The artifact layer is where the interface promises the most and admits the most gap.

The spreadsheet numbers back the direction: on SpreadsheetBench the agent scored 45.5% when editing files directly, against Copilot in Excel's 20.0% — though the appendix notes human performance sits at 71.33% overall, and OpenAI's grading used LibreOffice on OSX rather than the benchmark authors' Excel on Windows.

What a supervised agent in the composer demands of teams building on it

The implication for anyone integrating this is that the safety model is interactive, not automatic. OpenAI states plainly that the agent's 'overall risk profile is higher' given expanded tools and broader reach, and it singles out prompt injection — malicious instructions hidden in 'invisible elements or metadata' of a webpage that could push the agent to leak connector data or act on a logged-in site.

The mitigations that matter most here are frontend behaviors: confirmation before consequential actions, Watch Mode, interruption, and a one-click setting to delete browsing data and log out of all sessions. OpenAI's own advice is procedural — disable connectors when a task doesn't need them. In other words, the agent's dependability rests partly on how users operate the interface, not solely on the model.

For applied teams, that reframes the build question. Designing on top of ChatGPT agent means designing for a human who is expected to watch narration, grant permissions, and take over the browser at the right moments — and accounting for message limits of 400 per month for Pro and 40 for other paid tiers, with EEA and Switzerland access still pending. The interface is the control plane, and treating it as fully autonomous is the thing OpenAI is explicitly warning against.