Understanding ChatGPT Work: OpenAI's Most Powerful and Confusing Product Yet

On July 9th, 2026, OpenAI announced ChatGPT Work, and they've been furiously iterating on it ever since. It is an extraordinarily confusing and very powerful product. After weeks of experimentation, here's what we've figured out about it — and why it matters for anyone watching the AI industry.

The core pitch is simple: ChatGPT Work is a new tab alongside regular Chat, designed for tasks that need a clear outcome — briefs, decks, analyses, recurring updates, workflows, and files you can review and use. But that description barely scratches the surface of what's actually going on under the hood.

Two Products, One Name

The first thing to understand is that ChatGPT Work is actually two separate products sharing a single name. The more interesting version runs entirely in the cloud, accessible via chatgpt.com or the mobile apps — let's call it Work Cloud. The second version lives inside the ChatGPT desktop app (formerly known as Codex) and can access files and run programs directly on your computer — Work Local.

Work Local feels like a re-skinned version of Codex, designed to be less intimidating to non-developers. Work Cloud is where things get genuinely interesting.

What Work Cloud Can Do That Chat Cannot

OpenAI's official guidance says to use Chat when you want an answer or brainstorm, and Work when you want ChatGPT to complete a task with a clear outcome. That's almost entirely unhelpful — people have been using regular ChatGPT for all of those task categories for years. The real question is: what features does Work have that Chat doesn't?

After extensive experimentation, the key differentiators come down to six major features:

• Model selection: Work lets you choose between GPT-5.6 Sol, Luna, or Terra with up to Ultra reasoning levels, while Chat offers a more limited and less transparent selection
• Code execution with internet access: Work's sandbox can talk to the rest of the internet, not just a curated allowlist
• A full headless Chrome browser: Work can launch Chrome, load websites, fill forms, take screenshots, and run JavaScript against loaded pages
• A persistent shared filesystem: Files from previous Work sessions stick around and can be accessed across sessions
• ChatGPT Sites: Work can build and deploy entire websites on Cloudflare Workers with server-side capabilities
• Sub-agent sessions: Work can spawn parallel agents using different models for complex multi-step projects

Code Execution That Actually Talks to the Internet

This is perhaps the most exciting feature. Regular ChatGPT Chat runs code in a sandboxed container, but that container's internet access is blocked by a proxy. You can't install additional packages or interact with external APIs. Claude's equivalent container has allowed restricted internet access since September 2025, but the allowlist is very short — basically PyPI, NPM, and GitHub.

ChatGPT Work throws the doors wide open. The code execution environment can be configured with a specific list of allowed domains, but the default appears to be open to everything. You can have it clone GitHub repositories, install their dependencies, and then use those tools to interact with the rest of the web. This transforms ChatGPT from a conversational AI into something that looks a lot more like a general-purpose agent platform.

A Headless Chrome Browser Inside Your AI

The browser tool is a killer feature. ChatGPT Work can launch a full Chrome instance, navigate to websites, fill out forms, and take screenshots. If a site requires authentication, the browser can prompt you to take over and enter passwords and 2FA codes without routing those credentials through the model itself — a smart security design choice.

It can even execute JavaScript against the DOM of loaded pages. You can ask it to load a website and extract all the headings, run a scrape, or interact with a web app's UI — all from a conversational prompt. This is the kind of capability that used to require dedicated browser automation tools like Playwright or Puppeteer, now accessible from your phone.

Persistent Filesystems and ChatGPT Sites

Regular ChatGPT gives you a fresh filesystem for each chat session, isolated and ephemeral. Work Cloud changes this equation entirely. Each session gets its own scratch folder, but those folders persist across sessions. You can access files from previous chats, and the /workspace volume appears to be mounted across all running Work sessions — file edits from one can be seen by others in real time.

Then there's ChatGPT Sites, which takes this a step further. Work can build and deploy entire websites using Cloudflare Workers, complete with HTML, JavaScript, and server-side features backed by Cloudflare D1 and R2. These sites default to private but can be made public or shared with specific team members. The ability to go from a natural language prompt to a deployed, stateful web application — without writing a line of code yourself — is genuinely remarkable.

Sub-Agents and Scheduled Automations

For power users, Work can spawn sub-agent sessions running different models in parallel. If you're running a complex project that benefits from multiple agents working together — say, one writing code while another reviews it and a third runs tests — Work can orchestrate that. Chat cannot.

Work also supports scheduled prompt automations. You can tell it to run a search every day at 8am to check for a specific announcement, and it will either stay silent if nothing interesting happened or notify you when something changes. Combined with ChatGPT Sites, you could set up a scheduled task that updates a deployed website on an hourly basis — a fully automated content pipeline triggered by natural language.

The Safety Question

All of this power raises an obvious question: is it safe? The lethal trifecta model of AI agent risk warns about systems that combine access to private data, exposure to untrusted content, and a communication channel back to an attacker. ChatGPT Work combines all three.

An open browser, internet-connected code execution, and persistent filesystems create a significantly larger attack surface than a sandboxed chat container. OpenAI hasn't been particularly transparent about how they protect Work sessions against prompt injection attacks, and the product's rapid iteration pace means the security model may be shifting under users' feet.

That said, some design choices are encouraging. The browser's approach to authentication — letting humans enter credentials directly rather than routing them through the model — shows that OpenAI is thinking about these risks. The question is whether the protections are robust enough for a product that's already in the hands of millions of paying subscribers.

What This Means

ChatGPT Work represents a significant shift in how AI products are positioned. It's no longer just about conversation — it's about giving AI agents real tools, real persistence, and real access to the world. The gap between what a developer can do with code and what a non-technical user can do with a chat prompt is narrowing fast.

The confusing naming, the overlapping features, and the rapid iteration all suggest OpenAI is still figuring out what this product wants to be. But the trajectory is clear: ChatGPT is evolving from a chatbot into an operating system for AI agents. Whether that's exciting or terrifying probably depends on how much you trust the company building it.

For now, ChatGPT Work is available only to paid subscribers at $20/month and up. Free and Go-tier users don't have access. That paywall will likely come down eventually, but for now, the most powerful version of ChatGPT remains behind a subscription — a fitting metaphor for an industry where the most capable tools are increasingly available only to those who can afford them.