OpenAI Dots refers to persistent AI agents in ChatGPT, launched by OpenAI on September 29, 2026, capable of continuing a task between two conversations with their own ordinateur cloud and browser. For a business, the real issue is not the technical feat: it is controlling permissions, data, human approvals, and audit trails before allowing an agent to work continuously.
OpenAI Dots: what does this change for an SMB?
OpenAI Dots transforrms a one-off AI assistant into a continuous AI agent capable of retaining context, using connected applications, and making progress between two exchanges. According to the OpenAI documentation published on September 29, 2026, each dot has a cloud ordinateur and a cloud browser, which increases autonomy, but also the risk surface.
A dot is not just a more convenient chat window. It is a software agent that can read, decide, prepare an action, request approval, and resume later. This persistence changes the nature of control: you are no longer just approving a response, you are governing a comportement over time.
OpenAI indicates that dots can be created from the ChatGPT desktop app or the desktop web, but not from mobile or mobile web at the 2026 launch. The rollout is also gradual: Pro users hors European Economic Area, Switzerland, and the United Kingdom, Business Premium users in supported regions, and Enterprise customers through an admin-enabled beta, disabled by default.
For a business leader, the difference is simple. A poorly configured chatbot gives a wrong answer. A poorly governed persistent agent can attempt an action, handle a file, contact a service, or spread an error in a business tool. That is why the framing looks less like an innovation workshop and more like a mini digital governance project.
What concrete risks do OpenAI Dots add to your information system?
OpenAI Dots add three major risks in business: prolonged access to applications, execution of actions via connected tools, and exposure to malicious instructions hidden in external content. In 2026, AgentSecBench studies already classify agent risks around prompt injection, data leakage, and action integrity.
Indirect prompt injection is an underestimated trap. It consists of placing a hostile instruction in a web page, a document, or an email read by the agent, without the user realizing it. An arXiv paper published in March 2026 describes this mechanism: external content can influence an agent’s comportement without a direct instruction from the user.
The risk becomes more significant when the agent has access to secrets: SaaS accounts, customer documents, CRM, messaging, payroll files, document management. OpenAI specifies that enabling dots does not automatically grant access to all applications or all websites; plugin controls, application permissions, and existing account rights still apply. That is reassuring, but insufficient if human accounts are already too permissive.
The incidents rapported in late September 2026 show why caution is not just theorical. The Associated Press rapported that OpenAI had disclosed unexpected agent interactions with the SEC and other U.S. government sites, with no evidence of use of SEC credentials, non-public access, system modification, or compromise. BleepingComputer also rapported on September 26, 2026, that OpenAI agents had accidentally uploaded 53 images provided by users to third-party or public image-hosting sites.
In the projects we lead, we often see the same mistake: there is a lot of debate about the AI model, much less about the accounts used by the agent. Yet an agent connected with the rights of an administrative director or a sales manager mechanically inherits overly broad power. With a limited budget, it is better to reduce the access scope than to multiply spectacular tests.
What permissions should be given to an autonomous AI agent?
An autonomous AI agent should receive the minimum permissions necessary for its mission, with separate levels for reading, low-risk actions, and sensitive actions. OpenAI’s 2026 documentation notably provides the options Always ask, Allow read actions, Allow low-risk actions and, depending on eligible accounts, Allow all actions.
The right rule is not “trust the AI,” but “trust a scope.” A dot tasked with preparing meeting minutes can read a calendar and specific shared documents. A dot tasked with customer support can suggest a reply in Slack or by email, but should not issue a refund, delete an account, or modify a formule without human approval.
OpenAI describes several distinct control layers: provider autorization, OAuth scopes (rights accorded by an application), ChatGPT action settings, workspace restrictions, and security protections. These layers are not interchangeable. If one is too broad, the others do not always compensate properly.
To frame permissions, start from a written use case, not a demonstration. The approach is similar to that of a business application specifications document : objectives, data handled, users, connected systems, approvals, acceptable errors. Without this foundation, the agent quickly becomes a vague shortcut laid over processes that are already vague.
Here is a simple framework to start a pilot without opening things up too broadly:
- Define a named business owner, responsible for the outcome, approvals, and maintenance of the workflow.
- Create a dedicated service account, separate from an executive or administrator account.
- Limit connectors to essential tools: messaging, document storage, CRM, or the relevant support tool depending on the case.
- Enable read access before write access, then test low-risk actions in a non-critical environment.
- Block deletions, payments, password changes, software installations, and mass exports by default.
- Plan an emergency shutdown procedure: deactivation of the dot, revocation of OAuth tokens, and suspension of the dedicated account.
Honestly, the “Allow all actions” option is only justified in a very tightly controlled scope, with a usable audit historory and a team capable of monitoring deviations. For an SMB, it is rarely the right initial setting.
How much does a secure OpenAI Dots pilot cost in 2026?
A secure OpenAI Dots pilot mainly costs time for scoping, integration, and control, beyond the relevant ChatGPT subscription. In France, in 2026, serious scoping for an SMB often falls around €3,000 to €12,000 before tax as a forfee, depending on the number of connected applications and the expected level of security.
This budget does not correspond to “installing AI.” It covers business workshops, access mapping, test scenarios, approval rules, internal documentation, and sometimes the adaptation of existing tools. As soon as an agent interacts with a CRM, messaging, or client documents, the savings from skipping initial scoping become a false economy.
| Position | France 2026 price range | Typical timeline | Point of vigilance |
|---|---|---|---|
| Business scoping and risks | €1,500 to €4,000 before tax as a forfee | 3 to 7 business days | Define prohibited actions before connectors |
| Access and connector configuration | €2,000 to €6,000 before tax as a forfee | 1 to 3 weeks | Avoid overly permissive human accounts |
| Testing, logging, and shutdown procedure | €1,500 to €5,000 before tax as a forfee | 1 to 2 weeks | Test errors, not just the ideal case |
| Monthly maintenance and review | €500 to €2,000 before tax per month | Recurring | Review permissions after each new connected tool |
These amounts are ballpark figures observed in the French digital services market in 2026, not official OpenAI rates. Exact costs depend on your environment: Google Workspace, Microsoft 365, Slack, Notion, HubSpot, Salesforce, internal tools, hosting with OVHcloud, or the Cloudflare network layer.
On the agency side, the reflex is to start with a narrow pilot: one assignment, two or three connectors, a trial period of four to six weeks. It’s less appealing than a large deployment, but much more revealing. The first gains appear quickly, and so do the morts blind spots.
How do you log, audit, and stop a dot in case of a problem?
Securing a dot in a business environment relies on three operational capabilities: logging conversations and application calls, auditing the actions carried out, then quickly cutting off access if the comportement drifts. OpenAI states in 2026 that the Compliance API and Compliance Logs cover conversations and application calls for Enterprise uses of apps and plugins.
Logging is only useful if someone reads it. An unused log is reassuring on paper, but it does not protect an SME lors from a leak, a massive export, or an inconsistent action. The minimum is to keep records of access, the applications used, the actions requested, human approvals, and blocked errors.
OpenAI also specifies that certain sensitive actions, such as password changes or money transfers, require the user to take back control. Other actions, such as permanent deletion or software installation, may require approval. Custom Rules make it possible to define which supported actions are autonomous, subject to validation, or blocked, without being able to bypass central security requirements or Autoreview.
A good emergency shutdown plan fits on one page. Who disables the dot? Who revokes the OAuth tokens? Who informs the business owner, the DPO if personal data is involved, and the managed services provider? If you have to look for these answers during the incident, the procedure is already too slow.
The topic ties into classic cyber security best practices: least privilege, monitoring, backups, segmentation, and incident management. To expand on this aspect, a guide on a cyberattack in France and its operational lessons helps connect AI, access, and crisis management without unnecessary dramatization.
Should OpenAI Dots be connected to Slack, email, CRM, and payment systems?
OpenAI Dots can track tasks via ChatGPT, SMS, email, and Slack according to OpenAI’s 2026 documentation, with media also mentioning Microsoft Teams. Connecting a dot to sensitive tools should be done by business priority: messaging and documents first, CRM next, payment or banking only after legal, security, and accounting validation.
Launch coverage mentions more than 4,000 applications accessible via plugins or connected applications. That number is impressive, but it should not drive your roadmap. The more tools an agent can see, the more it can combine data and produce an unexpected action.
The CRM deserves separate treatment. Reading a customer record to prepare an email is one thing; changing a sales status, applying a discount, or closing an opportunité is another. The same logic applies to email: suggesting a draft presents little risk, sending automatically to a strategic client without review presents more.
Payment is the case where the obvious solution is often the wrong one. Connecting an agent too quickly to a transactional flow creates a delicate mix: personal data, consent, fraud, contractual liability, and evidence. To understand this change, the analysis of the payment by AI agent in e-commerce provides a useful perspective on the limits to set before automating the act of purchasing.
The same logic applies to business applications. If your internal system does not have a proper API, separate roles, or reliable logs, it is sometimes better to create an intermediary interface rather than give an agent direct access to a legacy tool. A lightweight, specialized, and low-cost AI model may even be preferable to a large general-purpose agent for certain quick tasks; that is the trade-off described in this feedback on thelow-latency AI and small models.
What deployment plan should you adopt before rolling out OpenAI Dots more broadly?
An OpenAI Dots deployment in a company should begin with a limited pilot, measured against a business outcome and stoppable at any time. In 2026, OpenAI emphasizes with Presence and the Agents API permissions, policies, testing, escalation, and production monitoring; these principles should come before broad automation.
The right pilot is not necessarily the most visible one. Choose a frequent, repetitive task with low consequences in case of error: summarizing support tickets, preparing meeting notes, document monitoring, sorting incoming requests. At first, avoid HR decisions, pricing, payments, healthcare, and customer disputes.
Measure little, but measure well. Time saved per week. Rejected approval rate. Number of blocked actions. Confidentiality incidents. Satisfaction of internal users. These indicators are worth more than a general discussion about productivity.
The deployment must also take SEO and visibility into account if agents produce or update public content. An agent that publishes without safeguards can create weak, inconsistent, or non-conforme content with your editororial line. On this topic, the visibility criteria in generative AI and search are detailed in the article on the GEO and AI Overviews trends.
Framing this type of project upstream avoids most unpleasant surprises. An outside perspective is especially helpful for setting the limits before the demonstration: what the agent can read, what it can propose, what it will never do alone, and what must remain under human responsibility.
FAQ about OpenAI Dots in companies
Is OpenAI Dots available in Europe in 2026?
OpenAI Dots is not available to Pro users in the European Economic Area, Switzerland, and the United Kingdom at the launch on September 29, 2026. Business Premium and Enterprise users are subject to separate terms depending on the supportées regions and administrator settings.
Can a dot change passwords or make a transfer on its own?
OpenAI indicates in 2026 that sensitive actions by a dot, such as a password change or a money transfer, require the user to take over. Certain permanent deletions or software installations may also require approval.
Do dots replace a traditional business workflow?
OpenAI Dots does not replace a well-designed workflow business process; a dot executes it or assists with it using governed permissions. If the process is ambiguous, the agent mainly risks accelerating existing errors.
What is the difference between OpenAI Dots and the Agents API?
OpenAI Dots cor corresponds to persistent agents in ChatGPT, while the Agents API, launched in public beta on September 10, 2026, serves developers creating cloud agents with hosted execution, memory, tools, and environments that can last several days.