OpenAI\u2019s ChatGPT Agent Mode<\/strong> \u2013 often called just ChatGPT Agent<\/strong> \u2013 is a newly launched feature that turns ChatGPT from a simple Q&A chatbot into a semi-autonomous digital assistant. When activated (by selecting \u201cAgent\u201d from the tools menu or typing Availability:<\/strong> As of July 2025, ChatGPT Agent is available to paying subscribers<\/strong> on certain tiers. OpenAI rolled it out first to ChatGPT Pro<\/strong> users (a $200\/month plan), with Plus<\/strong> and Team<\/strong> subscribers getting access shortly aftertheverge.com<\/a>techcrunch.com<\/a>. (High demand initially caused a slight delay for Plus\/Team rollouttheverge.com<\/a>.) Enterprise and Education accounts are expected to gain access later in the summerwired.com<\/a>. Free users do not have agent access yetwired.com<\/a>. OpenAI also imposes usage limits: Pro users are capped at ~400 agent tasks per month<\/strong>, while Plus\/Team users get ~40 tasks\/month<\/strong> during the initial launchwired.com<\/a>wired.com<\/a>. This cautious rollout reflects both the significant computing costs<\/strong> of agentic AI and its experimental nature, as OpenAI gathers data on real-world usewired.com<\/a>the-decoder.com<\/a>.<\/p>\n\n\n\n ChatGPT Agent combines capabilities from two prior beta features \u2013 \u201cOperator\u201d (a browsing\/interaction tool)<\/strong> and \u201cDeep Research\u201d (a long-form web research tool)<\/strong> \u2013 into a single systemtechcrunch.com<\/a>. It can fluidly switch between a visual browser<\/strong> (clicking and scrolling web pages like a user) and a text-based browser<\/strong> (quickly scraping and summarizing content), as neededwired.com<\/a>. In addition, it has a built-in terminal\/coding tool<\/strong> with restricted internet access for running code, analyzing data, and even generating PowerPoint ( Examples of what it can do:<\/strong> OpenAI and reviewers have demonstrated a range of uses:<\/p>\n\n\n\n Importantly, ChatGPT Agent works autonomously once given a task<\/strong>: it will break the task into sub-steps, decide which tool or website to use at each step, and attempt to complete the entire workflow \u201cfrom start to finish\u201d without needing step-by-step user instructionsreddit.com<\/a>pcgamer.com<\/a>. This agentic behavior \u2013 deciding when to browse, when to run code, what to click, etc. \u2013 is a major leap beyond the normal ChatGPT. However, it also means users must trust the AI to make certain decisions on its own. OpenAI\u2019s design puts the user \u201cin the loop\u201d for key decisions:<\/em> the agent will ask for confirmation before any action with real consequences<\/strong>, such as sending an email, making a purchase, or accessing a sensitive accounttechradar.com<\/a>. For example, it might present a draft email or an order summary and require the user to approve before it actually attempts to send or buy somethingtechradar.com<\/a>. If the user has linked their calendar or contacts, the agent may likewise request permission before scheduling an event or messaging someone. This safeguard is meant to prevent unwanted surprises and keep the user feeling in control even as the AI handles the busyworkwired.com<\/a>techradar.com<\/a>.<\/p>\n\n\n\n Under the hood, ChatGPT Agent runs on a new model that OpenAI claims is significantly more capable than previous versions (likely an iteration of GPT-4 with enhancements for tool use). In evaluations, this model has achieved state-of-the-art results on challenging academic and professional benchmarks<\/strong>:<\/p>\n\n\n\n OpenAI\u2019s Maxwell Zeff<\/em> noted that these benchmark gains roughly double the performance<\/strong> of prior GPT-4 based systems, indicating the new agent model is \u201cstate-of-the-art<\/strong>\u201d on complex reasoning taskstechcrunch.com<\/a>. It\u2019s worth noting, however, that a 41.6% pass@1 on HLE is still far from human expert-level (100% would be passing every question). So while the agent shows much improved capability<\/em>, it isn\u2019t infallible. The FrontierMath result, though dramatically higher than before, is still under 30%, meaning many advanced math problems still stump it. These benchmarks are best seen as encouraging milestones<\/strong> that the agent\u2019s technical underpinnings are moving forward quickly, but not evidence that it can ace every task reliably.<\/p>\n\n\n\n Early reviews from tech outlets<\/strong> have praised ChatGPT Agent\u2019s ambition and potential, but also highlighted its current limitations in real-world use. Major publications and testers have subjected the agent to a variety of everyday tasks \u2013 with mixed results:<\/p>\n\n\n\n In summary, user evaluations<\/strong> agree that ChatGPT Agent is impressively capable in scope<\/strong> \u2013 it can truly juggle a wide variety of tasks that earlier AI assistants could not. However, today\u2019s Agent often feels like an intern:<\/em> it\u2019s slow<\/strong>, sometimes misunderstands instructions<\/strong>, and frequently needs supervision or follow-up<\/strong> to get the job done righttheverge.com<\/a>theverge.com<\/a>. It shines in gathering information and generating content (summaries, comparisons, drafts), but falls short of the human assistant when it comes to taking direct actions in the real world<\/strong>, mainly due to intentional safety limitations (no direct account access, no autonomous financial transactions)theverge.com<\/a>theverge.com<\/a>. Reviewers recommend using it for research and tedious online tasks you might otherwise avoid, but not relying on it for anything urgent, high-stakes, or sensitive<\/strong> at this stagethe-decoder.com<\/a>pcgamer.com<\/a>.<\/p>\n\n\n\n Because ChatGPT Agent can perform actions (not just chat), it introduces new security and privacy risks<\/strong> that both OpenAI and experts have flagged. Unlike a standard chatbot, an agent with web access and tool use could potentially do harm (even if unintentionally) by leaking sensitive data, misusing its abilities, or being \u201ctricked\u201d into malicious acts. Key risks include:<\/p>\n\n\n\n OpenAI has been unusually transparent about these risks and mitigations. They published a detailed system card<\/strong> and engaged a \u201cRed Team<\/strong>\u201d of 16 external researchers (with expertise in security and biohazards) to stress-test ChatGPT Agent for vulnerabilitiesventurebeat.com<\/a>venturebeat.com<\/a>. In 40 hours of intensive testing, the red team attempted 110 attacks<\/strong> \u2013 from prompt injections to cross-site exploits and data leaksventurebeat.com<\/a>. They succeeded in discovering 7 broad exploit strategies<\/strong> that could have compromised the agentventurebeat.com<\/a>venturebeat.com<\/a>. Each of these was reported to OpenAI, and before launch the engineers fixed or mitigated all known critical issues<\/strong>. For instance, one exploit involved hidden instructions in a web page (as mentioned), another involved abusing the Google Drive connector to leak documentsventurebeat.com<\/a>. OpenAI\u2019s fixes included the filters and policies noted above, as well as a new \u201cdual-layer\u201d monitoring system<\/strong> that watches 100% of the agent\u2019s operations in real time (the first layer is a fast rule-based filter, the second is an AI reasoning model that examines anything suspicious)venturebeat.com<\/a>venturebeat.com<\/a>. According to a VentureBeat analysis, these defenses led to measurable security improvements \u2013 e.g. active data exfiltration attempts dropped from 58% success in older models to 67% being caught\/blocked in the agent<\/strong> (a 9% improvement), and \/agent<\/code>), ChatGPT gains access to a \u201cvirtual computer\u201d<\/strong> with a browser, code execution, and third-party app connectors, allowing it to perform complex, multi-step tasks on behalf of the usertheverge.com<\/a>techradar.com<\/a>. In essence, the agent can navigate websites, fill out forms, manage calendars, generate files (like slideshows or spreadsheets), run code, and use APIs \u2013 attempting to complete tasks much as a human would on a computer<\/strong>techradar.com<\/a>techcrunch.com<\/a>. OpenAI\u2019s CEO Sam Altman describes ChatGPT Agent as \u201ca new level of capability\u201d for AI systems that can \u201caccomplish some remarkable, complex tasks\u2026 using its own computer,\u201d though he emphasizes it is cutting-edge and experimental<\/em> at this stagereddit.com<\/a>reddit.com<\/a>.<\/p>\n\n\n\nTechnical Capabilities and Use Cases<\/h2>\n\n\n\n
.pptx<\/code>) presentations or Excel spreadsheets (.xlsx<\/code>) for the userwired.com<\/a>wired.com<\/a>. It also supports \u201cConnectors\u201d<\/strong> to external services \u2013 for example, users can grant it limited access to their Gmail, Google Drive, calendar, or other apps, so it can retrieve relevant information or even add events\/files on their behalftechcrunch.com<\/a>techradar.com<\/a>.<\/p>\n\n\n\n\n
Performance on Key Benchmarks<\/h2>\n\n\n\n
\n
Hands-On Reviews and User Evaluations<\/h2>\n\n\n\n
\n
Security Risks and Safeguards<\/h2>\n\n\n\n
\n