Understanding ChatGPT Work (simonwillison.net)

> My lethal trifecta model warns about the risks inherent in any agent system that combines access to private data with exposure to untrusted content and a way to communicate stolen information back to an attacker.

> ChatGPT Work combines all three!

The ChatGPT Work model would actually feel safer to me if they created a privacy boundary between the container-managing agent (browser operator/VM manager/code runner/etc) and the chatbot agent. Instead of me not typing privacy-sensitive things to the chatbot to avoid having them in my history, the chatbot would keep my history private from the container agent except on a need-to-know basis. That would remove the "access to private data" from the container's trifecta.

Not perfectly safe of course, just safer. Particularly if I could review the logs between the two agents.

I think most people are sleeping on the ChatGPT Work/Codex computer use feature. It's incredibly useful. I can remote in from the app, voice it instructions, then let it work in the background. When I tell it "draft a reply to this email (which it has access to thru the gmail connector) and attach the latest docs" or "fill out this multistep immigration electronic travel authorisation form using my passport files saved in the folder", it just asks for the relevant info and handles the rest. It opens its internal web browser and programmatically fills out the forms.

It gets the task done in 5-10 minutes. It's it bit slow since I'm not paying extra for ultrafast mode, but it gets the job done. Frees up the brain to do other tasks.

It's exactly like vibe coding but for computer tasks.

Codex in ChatGPT Desktop + 5.6Sol is my daily driver for non-coding things, and it's great. FWIW, I've not explored what differentiates Codex and Work modes- Simon notes that Work 'feels more like regular Codex re-skinned'. OpenAI seems to say that they're 'optimized' for SWDev and general knowledge work respectively, but reading between the lines- I suspect that yes, this boils down to a reskin.

I have been of the opinion for the last 6 months that this product category* is going to be something that sticks. I really think that OpenAI and Anthropic have totally dropped the ball on getting their respective desktop apps in front of the enterprise business user cleanly. Both jumped early, and tried to retroactively fix their jump by combining MVP (Work, Cowork) into their existing app.

By now, my suspicion is that the business user has baked into their mind 'that claude thing is just the chat app I copy-paste stuff out of, it was kinda annoying'. OAI+Ant really need to reset, and shamelessly relaunch ChatGPT/Claude Desktop as a new product- and market the hell out of it as some shiny new solution to everything.

I'll also say that MCP was (considering stateless now) a massive mistake. Not that MCP doesn't have it's niche, but it completely dominated the airwaves of AI for enterprise. People found it confusing, and it wasn't adopted by biglabs in a low-friction way. I recall distinctly late last year, neither had a client that would support local MCP servers- even though the buzz was peaking. And now, Anthropic still doesn't have great support- their OAuth flow is straight up broken, and they even collide with MCP using their own terminology (connectors)- which overlaps in a very weird way with built-in and 3rd party connectors. It's all very weird, and very anti-enterprise. I don't know where OAI is positioned on MCP support, because my userbase is 99.5% Anthropic rideordie, and I don't want to live with a client I can't manage**.

* That being desktop app for harness with shell tool + scheduling + agent-per-project/directory. At some point within that 6 months I've also lumped in browser use, and to a lesser extent, computer use, as must-have features.

** Referring to the MCP client ChatGPT Desktop uses. It's probably fine, but if I hit API direct, I can actually control how the harness facilitates the calls. Look how many GH Issues there are for MCP client things on OAI's end.

I recently figured out that I could use ChatGPT Work on my Pixel Phone to build native Android apps. It builds the app and you can then directly download/install the APK. So now I just build small utility apps on-the-go whenever I need them :)

I just updated the article to link to this site: https://codex-tool-reference.simonw.chatgpt.site/

Which I created using this prompt in a fresh Work session:

> Build a site that lists every one of your tools - nearly grouped into categories - and for each one explain what it does. Try to exactly duplicate arguments and tool descriptions where possible. Design aesthetic should be technical docs, minimal flare

UPDATE: I had it add all of the available skills too. This solved a mystery: I didn't see a tool for controlling the headless browser. It turns out that's handled by a skill that tells is how to run the browser via its Node.js REPL tool: https://codex-tool-reference.simonw.chatgpt.site/skills/cont...

It’s been part of the strategy from both OpenAI and Anthropic to split users into “devs” and “knowledge workers”. Hence Codex and Work (or Claude Code vs Cowork), and Chat is stuck in between. Codex can do everything Work can do and most non devs I know use Codex - from sales ppl doing weekly prioritisation of pipelines and customised email reach outs, to project managers using it as a living LLMWiki of all the projects and teams. In fact the biggest shift in business I’ve seen is the embrace of coding agents as defacto AI tool across knowledge workers.

ChatGPT work usage counts toward Codex entitlement

Some people have an agent-driven browser that controls the ChatGPT web UI and exposes it as a chat view in a custom harness or pi for normal chats (with image generation, file input capability).

I became a pelican fan, thanks to Simon. Looks like Simon keeps thinking about pelicans each time he prompts to any LLM. :)

Great article. I will add that Extra High and Pro levels of work are available in ChatGPT for Teams ($25 USD/seat, min 2 seats); not just the $100+ tier.

There is more to the browser, it can give you a remote desktop access to the browser.

So it's not completely headless.

But when I tried it, the remote control completely froze after a few seconds.

Understanding ChatGpt Retirement

—

> I believe ChatGPT Work sessions are billed against your Codex allowance, while ChatGPT Chat Sessions get their own, separate allowance. This may help explain the model availability differences

That's correct, and also why ChatGPT Work is DOA for me personally.

I need 100% of my Codex budget for Codex.

Too bad, it would have been nice to have a few extra features for the chat interface.

Work is for heavy work that runs in the background. It can make a hundred slide deck for me with speaker notes and visual verification of each slide, all without breaking a sweat. See my gist ac89399e688ab5c85ad021f091606e36 for the skill.

The things it can't do is use the embedding or TTS models as a part of its quota, which is sad. It also cannot read a video.

  > OpenAI could make this a lot less confusing
  > Figuring this all out took way more work than it should have.

Welcome to a generic large corporation, where they spend billions on making a product, and $0 on checking if the product makes any sense to a real user.