OpenAI's ChatGPT agent operates through a rendered browser, not an API

What OpenAI actually shipped

According to the system card, ChatGPT agent is a new agentic model in the same family as OpenAI o3. It folds together three capabilities that previously lived in separate products: Deep Research's ability to run multi-step research and produce reports, Operator's capacity to execute tasks in a remote visual browser environment, and a terminal tool with limited network access for running code, doing data analysis, and generating slides or spreadsheets.

It also reaches beyond the browser through first-party Connectors to external data sources such as Google Drive. So a single model now spans reading the open web, driving a browser, executing code, and pulling from a user's own files.

The browser is the interface, not the API

The Operator lineage matters for anyone building web frontends. The agent executes tasks through a remote visual browser, which means it interacts with a site the way a human does — by working against what the page actually renders, rather than through a structured API contract you control.

That inverts a common assumption. Most integration work assumes a machine consumer arrives at a documented endpoint. Here the machine consumer arrives at your login form, your cookie banner, your modal, and your DOM. The rendered UI becomes the surface the agent must parse and act on, so frontend decisions that were purely about human ergonomics now double as machine ergonomics.

Safety framed around reach and the terminal

OpenAI says safety was treated as an inherent part of the system, expanding on controls from Operator's research preview and adding safeguards for new risks it names explicitly: broader user reach and terminal access. The terminal's network access is described as limited, which is a deliberate constraint on a tool that can run code and generate files.

While we do not have definitive evidence that this model could meaningfully help a novice to create severe biological harm–our defined threshold for High capability—we have chosen to take a precautionary approach.Montana Labs

The company decided to treat the launch as High capability in the Biological and Chemical domain under its Preparedness Framework and activate the associated safeguards, despite lacking definitive evidence it meets that threshold. That is a precautionary classification, applied before the evidence forces it.

What this means if agents are visiting your product

The specific implication of this launch is that a widely reached agent may now traverse your frontend under a real user's session, combining what it sees on screen with files it can reach through Connectors. If your app is a place people keep data, the agent is a plausible visitor.

That argues for treating rendered UI as a first-class integration surface: stable and legible page structure, clear affordances the agent can act against, and access controls that assume an automated actor operating on a human's behalf. The system card describes capability and safeguards from OpenAI's side; the corresponding work on the frontend side is making your product predictable to something that reads the screen instead of the docs.