Simon Willison maps out what ChatGPT Work can actually do

OpenAI's ChatGPT Work has been out since July, but the documentation explains what it does rather than how, so Simon Willison spent real effort figuring out the actual capabilities. What he found is a much more powerful thing than regular Chat. The cloud version runs a code execution environment that can now talk to the open internet, so it installs packages and calls APIs directly. It launches a headless Chrome browser to fill in forms and manipulate the page with JavaScript. It keeps a persistent filesystem shared across chats, orchestrates sub-agents working in parallel, deploys full websites on Cloudflare Workers with D1 and R2 storage, and runs tasks on a schedule. It is only available to paying subscribers, not the free or cheapest tiers.

Because OpenAI does not publish the system prompts or tool descriptions, Willison did something practical: he had Work itself build a reference site listing all 223 registered tools and 44 skills, an unofficial spec that OpenAI's own docs lack. His larger warning is about security. Work combines access to private data, exposure to untrusted content from the web, and the ability to communicate outward. That is exactly his lethal trifecta, the three ingredients that make prompt injection dangerous, and here all three are switched on at once.

Why it matters

If you are deciding whether to route agent work through ChatGPT Work, the internet-connected code sandbox and headless browser are genuinely useful, but they also mean a malicious web page could steer the agent against your own data. Test it on low-stakes tasks before you give it anything sensitive.