On 30 August, Simon Willison published what he had worked out about ChatGPT Work, a product OpenAI announced on 9 July. His verdict in one line: “It is an extraordinarily confusing and very powerful product.”
The product is not new. The interesting thing is what it took to find out what it does, and that anyone can repeat it on whatever their own company has deployed.
The gap he names
Willison spells out why it was hard, and the first half is a communications problem rather than a technical one:
“OpenAI explain Work in terms of what it’s for, not what it actually does”
The official guidance says to use Work “when you want ChatGPT to complete a task with a clear outcome, such as a brief, deck, analysis, recurring update, workflow, or file you can review and use.” He finds that almost useless, for a reason any buyer will recognise: he had been doing all of those things in ordinary chat for years.
A description of purpose does not tell you what a system can reach. Only a description of capability does, and the second half of his complaint is that the system prompts and tool descriptions are not published.
What it can reach
After extensive experimentation, the features that distinguish Work from ordinary chat:
- A code execution environment with internet access. It can be restricted to an allowlist of domains, but the default appears to be open. For comparison, Willison notes that the equivalent container from another vendor permits a very short allowlist, mostly package registries and code hosting.
- A full headless Chrome browser. It loads sites, fills forms, takes screenshots and runs JavaScript against the DOM of loaded pages. Where a site requires a login, the browser can hand over to the user for passwords and two-factor codes without those credentials passing through the model.
- A persistent filesystem shared between sessions. Each session gets a scratch folder, and those folders survive. The volume appears to be mounted into every running session, so a file written by one is immediately visible to another. Willison reports 171 folders in his.
- The ability to publish websites, to run sub-agent sessions, and to schedule prompts that run on a recurring basis.
Read that list as a permissions inventory rather than a feature list. A system that can execute code, reach arbitrary domains, drive a browser through an authenticated session, and keep files where the next session can find them is not a writing assistant with extras.
The method worth stealing
Willison could not get the tool list from the documentation, so he asked the product for it. He started a fresh session and prompted it to build a site listing every one of its tools, grouped into categories, duplicating the argument and tool descriptions where possible.
The result listed 223 registered tools. Six of those were his own, served through a personal integration, so 217 came with the product. Suspecting the browser automation was underdescribed, he asked the same session to add full copies of every skill as separate pages. There were 44.
That is the part a marketing or IT lead should take away, and it costs one prompt. Whatever AI workplace your company has bought, you can ask it to enumerate its own tools and skills and read the answer against what you were told when you bought it. It is not an audit and it is not authoritative, since the model is describing itself. It is still a great deal more specific than a page explaining what the product is for.
The risk he flags, in his own terms
Willison applies his own framework and does not soften the result:
“My lethal trifecta model warns about the risks inherent in any agent system that combines access to private data with exposure to untrusted content and a way to communicate stolen information back to an attacker. ChatGPT Work combines all three!”
Private data through the persistent shared filesystem. Untrusted content through a browser that loads arbitrary pages and a code environment that reaches arbitrary domains. An outbound path through the same two. He says he would like to hear from OpenAI how Work sessions are protected against prompt injection, and expects the answer involves the same automatic review used elsewhere.
What this does not say
The product is not new, and this is not a launch. ChatGPT Work was announced on 9 July 2026. What is new is one person’s analysis of it, published on 30 August. Reporting the older date as a release would misstate both.
The tool count is not an official figure. The 223 came from the product describing itself in response to a prompt, and six of them belonged to the author rather than to OpenAI. Treat it as an order of magnitude produced by a repeatable method, not as a specification.
No exploit is described here. The lethal trifecta is a risk model about what an architecture makes possible. Willison names an open question about protection and does not report a compromise.
“The default appears to be open” is an observation, not a documented setting. He describes what he found in use. Anyone whose decision rests on that should verify it in their own tenant.
What to do with it
Ask your deployed system to list its tools and skills, then compare that list with the pitch you bought. One prompt, and the gap between the two is the part nobody wrote down for you.
Inventory reach, not purpose. The questions that matter are which domains the code environment may contact, whether browser sessions can inherit a real login, and whether files persist across sessions and across users. Purpose descriptions answer none of these.
Treat a shared persistent filesystem as a shared drive, because it is one. If one session can read what another wrote, then the boundary you assumed between two pieces of work does not exist, and neither does the boundary between a trusted document and one that arrived from outside.
If all three trifecta conditions are met, decide that on purpose. They may well be acceptable for your use. The failure mode is meeting all three without anyone having noticed, which is exactly what happens when a product is documented by what it is for.
Sources
- Simon Willison, “Understanding ChatGPT Work”, 30 August 2026: https://simonwillison.net/2026/Aug/30/understanding-chatgpt-work/ (retrieved 1 September 2026). Source of the 9 July 2026 announcement date, the quoted verdict on the product being extraordinarily confusing and very powerful, the quoted criticism that OpenAI explain Work in terms of what it is for rather than what it does, the quoted official guidance on when to use Work, the distinguishing feature list including code execution with internet access, the headless Chrome browser and its credential handover behaviour, the persistent filesystem shared between sessions and the 171 folders, the prompt used to make the product enumerate its own tooling, the 223 registered tools of which six were the author’s own, the 44 skills, and the quoted lethal trifecta passage together with the observation that ChatGPT Work combines all three conditions. Control terms confirming the retrieval was intact: “ChatGPT Work” (26 occurrences), “223” (1), “lethal trifecta” (1).
- The comparison with another vendor’s container allowlist is Willison’s own, reported here as his observation rather than as an independently verified fact.