OpenAI announced ChatGPT Work on July 9 and has been iterating on it rapidly since. The product is powerful but somewhat confusing; usage and capabilities differ depending on which of the two variants you access.
Two distinct products: Work Cloud and Work Local
- Work Cloud: the cloud-hosted version available via chatgpt.com and through the ChatGPT mobile apps. The remainder of this article focuses primarily on this variant.
- Work Local: provided through the ChatGPT desktop application (previously called Codex). This variant runs on your local machine, can access files and execute programs on your computer, and resembles a less intimidating Codex for non-developers.
Access and pricing
Currently, both flavors of ChatGPT Work are available only to subscribers paying $20 per month or more. Free users and the $8/month Go plan do not have access.
When to use Chat vs. Work
OpenAI’s guidance: use Chat for answers, explanations, brainstorming, or short drafts; use ChatGPT Work when you want ChatGPT to complete a task with a clear outcome (for example, a brief, deck, analysis, recurring update, workflow, or file you can review and use). In practice these categories overlap, and many users have completed such tasks in the regular Chat interface for years. The more useful distinction is to look at the specific features Work provides that Chat does not.
Key features Work adds over Chat
After extensive experimentation, the author identifies these Work-specific capabilities:
- Model options: GPT-5.6 Sol, Luna, or Terra with reasoning levels (Light, Medium, High, Extra High, Max, Ultra), and GPT-5.5 with Light–Extra High.
- A code execution environment that can access the internet.
- A full headless Chrome browser for loading pages, filling forms, taking screenshots, and running JavaScript in the page DOM.
- A persistent filesystem shared between sessions (scratch folders under /workspace/scratch).
- The ability to publish ChatGPT Sites using Cloudflare Workers, including server-side features backed by Cloudflare D1 and R2.
- The ability to run sub-agent sessions (parallel agents) with Sol, Luna, and Terra.
- Scheduled prompt automations that run prompts on a schedule.
(Note: some scheduled prompt functionality appears to have migrated to regular Chat as well.)
Model selection and availability
Work presents selectable Sol, Luna, and Terra options across multiple reasoning levels; GPT-5.5 is also available. The Chat interface shows different labels (5.6 Instant, Medium, High, Extra High, and Pro), and some higher-tier options (Extra High, Pro) are restricted to $100+/month subscribers. The author suspects differences in model availability are related to separate billing/allowance systems (Codex allowance vs. Chat sessions).
Internet-capable code execution
Perhaps the single most compelling Work feature for the author is that the code execution environment can reach the broader internet. Regular Chat containers block outbound access via a proxy, preventing installs or API interactions that require network access. Work can be configured with an allowlist, but the default appears to be far more permissive.
This allows Work to clone GitHub repositories, install dependencies, and run tools that interact with external websites and APIs — significantly expanding what the code-interpreter pattern can do in practice. The author contrasts this with Anthropic Claude’s container, which has allowed restricted internet access since its launch but with a short allowlist.
Full headless Chrome browser
Work can spin up a full Chrome instance: load sites, interact with forms, take screenshots, and execute JavaScript against the DOM. If a page requires sign-in, the browser can prompt the user to take control and enter credentials and 2FA codes locally, without routing those secrets through the model.
As an example, the author asked Work to load simonwillison.net and extract headings with JavaScript. Work launched a browser instance and executed a Playwright-style evaluation that collected heading tags and their text.
Persistent, shared filesystem
Unlike Chat sessions that receive a fresh temporary filesystem per chat, Work assigns each session a persistent scratch folder under /workspace/scratch (e.g., /workspace/scratch/e00a0a017944). These folders persist across sessions and appear mounted to all currently running Work sessions, so file edits made in one session are immediately visible in others. The author reports seeing 171 such folders.
Note that sharing a filesystem does not necessarily imply a shared process space; localhost servers started in one session may not be accessible from another.
ChatGPT Sites: build and deploy websites
Work can build and deploy full websites to Cloudflare Workers, supporting HTML/JavaScript and server-side logic, including stateful features using Cloudflare D1 and R2. The author provides an example site they built with the feature: london-pelicans-in-her-piety.simonw.chatgpt.site, created from a prompt that searched London for examples of the medieval "pelican in her piety" motif, output a JSON file, and published the site.
Sites are private by default but can be made public or shared with specific team members on team plans.
Sub-agents and parallel workflows
Work supports running sub-agents (parallel agents) using Sol, Luna, and Terra. This is a power-user capability intended for complex projects that benefit from multiple agents working together.
Scheduled prompt automations
Work can schedule prompts to run at specified intervals (for example, a daily 8 a.m. check for a Waymo launch date announcement). These scheduled prompts can either report that nothing of interest happened or notify the user of new findings. The author notes this functionality also appears to be available in Chat, but in Work it can be combined with Work-only features (e.g., automatically updating a ChatGPT Site hourly).
Safety considerations
The author raises security concerns: their "lethal trifecta" model highlights risks when an agent system combines access to private data, exposure to untrusted external content, and a channel to exfiltrate information. ChatGPT Work brings all three elements together.
They ask for more detail from OpenAI on defenses against prompt injection and other attacks; the likely protective mechanism is an automatic review system similar to Codex’s auto-review, but the author would like more transparency.
Suggestions for clearer communication from OpenAI
The author identifies two communication issues that made understanding Work harder than necessary:
- OpenAI explains Work in terms of intended use cases rather than the concrete capabilities and tools it actually exposes.
- OpenAI continues to hide system prompts and detailed tool descriptions, which impedes users trying to understand the exact behavior of the agent.
Publishing the exact system prompt and tool descriptions used by ChatGPT Work would reduce the need for reverse-engineering and experimentation.
Conclusion
ChatGPT Work exists as two deployment variants (Cloud and Local) that bring a set of powerful features to paying subscribers: internet-capable code execution, a full browser automation tool, a persistent shared filesystem, the ability to publish sites via Cloudflare Workers, sub-agent orchestration, and scheduled automations. These capabilities expand what users can automate with ChatGPT but also raise nontrivial security and transparency questions that merit further detail from OpenAI.
