ChatGPT Work decoded: cloud code execution, a live browser, and the lethal trifecta

Simon Willison unpacks ChatGPT Work, OpenAI’s confusing but powerful product line launched July 9th, 2026. It’s really two things: a cloud version (Work Cloud) accessed through chatgpt.com and the mobile apps, and a local version (Work Local) bundled with the rebranded Codex desktop app that runs code and touches files on your own machine. Both are gated to paying subscribers at $20/month and up. The cloud flavor is the interesting one, and its pitch as an alternative to Chat is muddy — the real distinction is a set of capabilities Chat simply lacks.

Chief among them is a sandboxed code-execution environment with open internet access, letting the agent clone GitHub repos, install dependencies, and hit arbitrary web APIs — far beyond the short domain allowlist Anthropic’s Claude container permits. Work also ships a headless Chrome instance that can load pages, fill forms, run JavaScript against the DOM, and hand off to the user for logins and 2FA without exposing credentials to the model. Other exclusives include a persistent /workspace filesystem shared live across concurrent sessions, one-click deployment of ChatGPT Sites on Cloudflare Workers (with D1 and R2 for stateful features), sub-agent orchestration across the Sol/Luna/Terra models, and scheduled recurring prompts.

The combination raises a real security question. Willison notes that Work satisfies all three legs of his “lethal trifecta” — access to private data, exposure to untrusted content, and an outbound channel to exfiltrate it — which is precisely the recipe for prompt-injection-driven data theft. The power that makes Work useful is the same power that makes it dangerous, and OpenAI’s threadbare changelogs leave much of its actual behavior to be reverse-engineered by users.