OpenAI dots: what they are and how they are governedOpenAI dots：它是什么，如何被管控
An always-on agent with its own computer, read from OpenAI's own documents: the control model is clearly documented; what a customer can export for audit is not.
一个拥有独立电脑的常驻智能体，依据 OpenAI 自己的文档：管控模型有清楚的文档；客户能导出什么用于审计，文档里没有说明。
- Date · 日期
- 2026-10-04
- Status · 状态
- Draft — vendor documents only; no independent test or customer evidence草稿 — 仅有厂商文档；没有独立测试或客户证据
- Author · 作者
- 🌱
- Tags · 标签
- agents, always-on, OpenAI, permissions, auto-review, governance
- Question · 研究问题
- What is a dot, who controls what it may do, and what evidence of its actions does a customer get?dot 是什么，谁控制它能做什么，客户能拿到哪些关于它行动的证据？
- Addresses · 对应
- Q5, Q6, overlaps Q2, Q3 · H1, H4
What a dot is, in plain terms先用大白话说：dot 是什么
A normal chatbot answers when you ask and stops. A dot is closer to a remote assistant you hired: it has its own laptop (a cloud computer and browser), it has the logins you gave it to your apps, it keeps notes about you, and it keeps working on your projects when you are away. You can message it in ChatGPT, Slack or Teams. When you are not talking to it, it may look around in your connected apps for useful things to do, but in that mode it can only read. Before it does anything that touches your accounts (send an email, delete files, spend money) a separate reviewer model checks the action, and some actions it must hand back to you.
普通聊天机器人是你问它答，答完就停。dot 更像你雇的一位远程助理：它有自己的“笔记本电脑”（云端电脑和浏览器），有你授权给它的各类应用账号，会记笔记了解你，你不在时也会继续推进你的项目。你可以在 ChatGPT、Slack 或 Teams 里给它发消息。不和你对话时，它可能在你已连接的应用里“四处看看”找事做，但这个模式下它只能读取。在它做任何会碰到你账号的事之前（发邮件、删文件、花钱），会有另一个审查模型先检查，有些动作它必须交还给你来完成。
This paragraph is my plain-language paraphrase of the sources below, not an OpenAI claim.
这一段是我对下列来源的大白话转述，不是 OpenAI 的原话。
Executive summary摘要
OpenAI launched dots on 2026-09-29 as always-on agents on GPT-6 Astra for Pro, Business Premium and (as a beta that an admin must enable) Enterprise [1]. The documents describe four stacked control layers: safeguards OpenAI fixes, workspace admin switches (off by default for Enterprise), per-user rules and approvals, and the dot's own sandbox [1][2][3]. The system card publishes unusually specific test numbers for prompt injection and persistence, and also admits remaining vulnerabilities and measurable boundary violations [4]. What the documents I read do not show is a customer-facing audit log of a dot's actions beyond an in-app Activity View, and memory the owner cannot inspect item by item [3]. This is a gap in the documentation I read, not proof that such a log does not exist. For this research programme the dots material is direct evidence on Q5 (self-service vs central gating) and a concrete case for Q6 (continuous evidence), while weakly touching Q2 and H4.
OpenAI 于 2026-09-29 推出 dots：基于 GPT-6 Astra 的常驻智能体，面向 Pro、Business Premium，以及（需管理员开启的测试版）Enterprise [1]。文档描述了四层叠加的管控：OpenAI 固定的保护、工作区管理员开关（企业版默认关闭）、用户级规则与批准、dot 自己的沙箱 [1][2][3]。系统卡给出了异常具体的提示注入与持续运行测试数据，同时承认仍有漏洞和可测量的越界行为 [4]。我读到的文档里没有的是：除应用内“活动视图”外面向客户的动作审计日志，以及所有者无法逐条查看的记忆 [3]。这是我读到的文档里的缺口，不能证明这类日志不存在。对本研究项目，dots 资料是 Q5（自助与集中管控）的直接证据、Q6（持续证据）的具体案例，对 Q2 和 H4 只有弱关联。
Diagram图示
Key findings主要发现
| # | Finding · 发现 | Cite |
|---|---|---|
| F1 | Dots were announced 2026-09-29: each has its own cloud computer and browser, connects to over 4,000 apps through plugins, and is reachable in ChatGPT, Slack and Teams.dots 于 2026-09-29 发布：每个 dot 有独立云电脑和浏览器，通过插件连接 4,000+ 应用，可在 ChatGPT、Slack、Teams 中联系。 | [1] |
| F2 | Rollout: Pro and Business Premium in eligible markets; Enterprise (including Edu and Healthcare) can try the beta when the workspace admin enables it. The docs add that Pro is unavailable in the EEA, UK and Switzerland.推出范围：符合条件市场的 Pro 与 Business Premium；Enterprise（含 Edu、医疗）在管理员开启后可试用测试版。文档补充 Pro 在 EEA、英国、瑞士不可用。 | [1] [6] |
| F3 | For Enterprise, “Use dots”, local computer access and custom rules are all off by default. Other dots permissions only apply to members who have access. Access can be given per role or group, and every role granting it must be removed to revoke it.在 Enterprise 中，“使用 dots”、本地电脑访问、自定义规则默认全部关闭；其余权限只对已获准的成员生效。可按角色或群组授权，撤销时必须移除所有授予它的角色。 | [2] |
| F4 | Cloud browser use, cloud network access, cloud computer use and the password manager are separate workspace switches; a dot's cloud computer does not inherit a member's VPN, browser sign-ins or device policies. Enterprise model controls and default-model settings do not apply to dots.云端浏览器、云端联网、云电脑使用和密码管理器是相互独立的工作区开关；dot 的云电脑不继承成员的 VPN、浏览器登录或设备策略。企业的模型控制与默认模型设置不适用于 dots。 | [2] |
| F5 | Users can set Custom Rules per action type with four handlings (act without asking, act when told, ask first, hand off). OpenAI states these cannot override built-in safety requirements, Auto-review, or the limits on proactive research.用户可对每类动作设置自定义规则，有四种处理方式（直接做、被告知再做、先询问、交还给人）。OpenAI 声明这些规则不能覆盖内置安全要求、Auto-review 和主动研究的限制。 | [3] [6] |
| F6 | Changing a password or transferring money requires the human to take over; permanently deleting data or installing software may need approval each time; some approvals (e.g. recurring messages) can be given in advance but only for what was authorised.修改密码或转账必须由人接手；永久删除数据或安装软件可能每次都需批准；有些批准（如定期消息）可预先给出，但仅限已授权的内容。 | [3] |
| F7 | Proactive background research uses read-only tools: it cannot send messages, change plugin content or control a browser or computer. Any follow-up must go through the usual action rules.主动后台研究使用只读工具：不能发消息、改动插件内容或控制浏览器/电脑；任何后续动作都要走常规动作规则。 | [1] [3] |
| F8 | Auto-review is a separate reviewer model that checks certain planned actions against instructions, rules and safety requirements. In Codex, OpenAI reports about 200x fewer human stops and ~99% approval of reviewed actions; for dots the system card says the reviewer got a “dots policy”.Auto-review 是一个独立的审查模型，按指令、规则和安全要求检查部分计划动作。在 Codex 中，OpenAI 报告人工中断减少约 200 倍、被审查动作约 99% 获批；对 dots，系统卡称审查者使用了“dots policy”。 | [4] [5] |
| F9 | Prompt injection test: 100 rollouts with 50,000 simulated emails (16,600 attacks) and 100 iterative attack chains (2,638 attempts) produced no scored attack successes. Human red-teaming found issues that were mitigated in tested scenarios, and OpenAI says known vulnerabilities remain.提示注入测试：100 次运行共 50,000 封模拟邮件（16,600 封为攻击），另有 100 条迭代攻击链（2,638 次尝试），均无计分的攻击成功。人工红队发现了问题，已在测试场景中缓解；OpenAI 说已知漏洞仍存在。 | [4] |
| F10 | Persistence tests: after a mid-task permission or scope change, dots passed 45 of 49 episodes (91.8%), including all 17 explicit permission changes. Moderate scope violations in chained tasks roughly doubled (8.6% to 19.7% of samples) when intervening tasks doubled. Unwanted persistence after a warning appeared in about 15% to 17% of rollouts.持续运行测试：任务中途权限或范围变化后，dots 通过 49 个情景中的 45 个（91.8%），包括全部 17 个明确的权限变更。链式任务中，插入任务数翻倍时中度越界约翻倍（样本的 8.6% 升至 19.7%）。警告后“不当坚持”出现在约 15% 至 17% 的运行中。 | [4] |
| F11 | The owner sees task steps in an Activity View and can pause, redirect or stop the dot. Deleting a dot does not undo completed actions. A dot's memory is shared with ChatGPT memory; owners currently cannot view, edit or delete individual dot memories, and disconnecting an app does not remove context already built.所有者可在“活动视图”中看到任务步骤，并可暂停、改向或停止 dot。删除 dot 不会撤销已完成的动作。dot 的记忆与 ChatGPT 记忆共享；所有者目前不能查看、修改或删除单条记忆，断开应用也不会清除已形成的上下文。 | [3] [6] |
| F12 | OpenAI previews “specialist dots” with their own identity, credentials and access, in enterprise pilots, and says it is working with Microsoft to integrate them with Agent 365 governance controls.OpenAI 预览“专用 dots”：拥有自己的身份、凭据和访问权限，先做企业试点，并称正与微软合作，把它们接入 Agent 365 的治理控制。 | [1] |
Evidence notes证据说明
Admin help page: Enterprise dots access is off by default; local computer access and custom rules are off by default too. [2]
管理员帮助页：Enterprise 的 dots 访问默认关闭；本地电脑访问和自定义规则同样默认关闭。[2]
The system card's own caveats: the evaluations isolate model behaviour without the full production safeguards in some cases, rates are “not necessarily representative of production”, and the one-year time-budget runs may show less warning-persistence only because the model engages less. [4]
系统卡自己的限定：部分评估在没有完整生产防护栈的条件下进行，比率“不一定代表生产环境”，一年时间预算下“不当坚持”更低，可能只是模型参与度更低。[4]
Internal inconsistency in [4]: one chained-task passage says intervening tasks went from five to ten, while a later sentence refers to seven-task and twelve-task settings. I report the 8.6% to 19.7% figures as stated for “five to ten” and have not resolved the discrepancy.
[4] 内部的不一致：链式任务一段称插入任务从五个增至十个，后文又提到七个和十二个任务的设置。我按“五到十”转述 8.6% 到 19.7%，未能澄清这一差异。
Not read or not found: the figures (charts) in the system card appendix, including the Auto-review recall by category (no source yet for those numbers); the “dots safety blog”; any compliance, audit-log or data-export API for dots. The Enterprise docs summary mentions usage monitoring through an Analytics API [6], but I did not verify what it records. Pages on learn.chatgpt.com were read through a summariser, so [6] carries lower confidence.
未读到或未找到：系统卡附录中的图表（包括按类别的 Auto-review 召回率，这些数字 no source yet）；“dots 安全博客”；dots 的合规、审计日志或数据导出 API。企业文档摘要提到可通过 Analytics API 监控使用情况 [6]，但我没有核实它记录什么。learn.chatgpt.com 页面是通过摘要工具读取的，因此 [6] 置信度较低。
Every source here is OpenAI's own. There is no independent test, customer deployment report or regulator view in this note.
本文所有来源都是 OpenAI 自己的，没有独立测试、客户部署报告或监管方观点。
Industry examples行业示例
| Company | Product | What it shows | Source |
|---|---|---|---|
| OpenAI | Dots | Default-off, role-scoped enablement and a fixed safety layer users cannot disable: one concrete answer to “what is centrally gated”.默认关闭、按角色启用，再加用户无法关闭的固定安全层：对“什么由集中管控”的一个具体答案。 | [2] |
| OpenAI | Auto-review | A model replaces many human approvals at the action boundary (in Codex, about 200x fewer stops); OpenAI itself says it is not a guarantee and can be misled.用模型替代许多动作边界的人工批准（在 Codex 中人工中断约减少 200 倍）；OpenAI 自己说它不是保证，也可能被误导。 | [5] |
| Microsoft | Agent 365 | Named as the intended place to govern specialist dots (stated goal only).被点名为治理专用 dots 的目标平台（仅为声明的目标）。 | [1] |
Architecture implications架构含义
A dot is an agent whose identity, memory, scheduler and sandbox all run on the vendor's side. The customer's documented levers are the admin switches, the plugin permissions and the rules; the documents I read do not say whether the customer can export the action log, and the owner cannot inspect memory item by item. Compared with the NVIDIA OpenShell pattern in the earlier note, where policy enforcement and an OCSF audit trail sit under the agent in the customer's stack, dots put enforcement inside the vendor's product.
dot 是身份、记忆、调度器和沙箱都运行在厂商一侧的智能体。文档中写明的客户杠杆是管理员开关、插件权限和规则；我读到的文档没有说明客户能否导出动作日志，所有者也不能逐条查看记忆。与前一篇笔记中 NVIDIA OpenShell 的模式（策略强制和 OCSF 审计轨迹位于客户技术栈内、智能体之下）相比，dots 把强制执行放在厂商产品内部。
MDLC implicationsMDLC 含义
The documents I read describe no version pinning or release-approval step for customers, so a dot looks like something that changes under the customer (not confirmed). The release-time evidence in the system card is OpenAI's, not the deployer's. What a deployer can still own is the enablement decision (which roles, which capabilities), the plugin and rule configuration, and whatever monitoring it builds around outputs. See the earlier note on continuous evidence.
对客户而言，dot 我读到的文档没有描述客户可固定版本或批准发版的环节，所以 dot 看起来会在客户之下变化（未证实）。系统卡里的发版期证据是 OpenAI 的，不是部署方的。部署方仍能掌握的是启用决定（哪些角色、哪些能力）、插件与规则配置，以及围绕产出自建的监控。参见前一篇关于持续证据的笔记。
My interpretation我的解读
Dots show a mature answer to “who may switch the agent on and what can it touch” (Q5): a tiered model with a fixed floor, off-by-default enterprise switches and per-role grants. They give a much thinner public answer to “what evidence will I have afterwards” (Q6, Q2): an in-app activity view, vendor-run monitoring, and published pre-launch tests, but nothing in the documents I read that a customer could export for its own auditors. That may be a documentation gap or a feature not yet built; I cannot tell which. The system card's own numbers (boundary violations that grow with task chains, warning persistence around 15% to 17%) suggest a human or automatic gate is still doing real work, which fits the view that approval design matters more than the model.
dots 对“谁可以启用智能体、它能碰什么”（Q5）给出了成熟的答案：有固定底线、企业开关默认关闭、按角色授权的分层模型。对“事后我有什么证据”（Q6、Q2），公开给出的答案少得多：应用内活动视图、厂商运行的监控、发布前的公开测试，但在我读到的文档里，没有客户可导出给自家审计的东西。这可能只是文档没写，也可能是功能还没做，我无法判断是哪一种。系统卡自己的数字（链式任务中越界增多、警告后不当坚持约 15% 至 17%）说明人工或自动闸门仍在发挥实际作用，这与“批准设计比模型更重要”的看法一致。
Hypotheses假设
Vendor-hosted always-on agents will be gated in enterprises by default-off capability switches per role, and regulated firms will ask for exportable action logs before widening access.
厂商托管的常驻智能体在企业中会以“按角色、默认关闭的能力开关”来管控，受监管机构会先要求可导出的动作日志，再扩大授权。
Open questions未决问题
Does an enterprise get an exportable, tamper-evident record of every dot action (the documents I read do not say)? Will Agent 365 or a similar control plane become the system of record for dot actions (Q2, H4)? How does Auto-review's recall hold up on ambiguous authorisation, which the system card says is weakest? Are the reported boundary-violation rates stable across versions?
企业能否拿到每个 dot 动作的可导出、防篡改记录（我读到的文档没有说明）？Agent 365 或类似控制平面会成为 dot 动作的记录系统吗（Q2、H4）？系统卡称“授权含糊”场景最弱，Auto-review 在其上的召回表现如何？报告的越界比率跨版本是否稳定？
What would change my view?什么会改变我的看法？
- OpenAI documentation of a compliance or audit-log export for dots (would weaken the “thin evidence” reading).
- OpenAI 公布 dots 的合规或审计日志导出（会削弱“证据偏薄”的判断）。
- Independent red-team or customer reports contradicting the system card's injection results.
- 独立红队或客户报告与系统卡的注入测试结果相矛盾。
- Evidence that enterprises enable dots broadly without per-role gating.
- 有证据表明企业不做按角色管控就广泛启用 dots。
Link to hypotheses与假设的关系
Q5: direct evidence for a tiered answer (fixed floor, admin switches, user rules), from one vendor only. Q6: a concrete always-on case with vendor-run continuous monitoring but no customer-exportable action log found in the documents read (an absence of documentation, not proof of absence). Q2: action visibility is an in-app view; Agent 365 is a stated intention only. Q3: related, since Auto-review is a model standing in for human approval at action level, though not for evidence acceptance. H4: weak support at most (vendor plans to plug into a governance control plane, unverified). H1: weak support, since OpenAI publishes eval results as a launch artifact, but this is a vendor's own release evidence. Not enough to change thesis confidence; it feeds the monthly review.
Q5：对分层答案（固定底线、管理员开关、用户规则）的直接证据，仅来自一家厂商。Q6：一个具体的常驻案例：有厂商运行的持续监控，但在所读文档中没找到客户可导出的动作日志（只是文档中没有，不是证明不存在）。Q2：动作可见性只是应用内视图；Agent 365 仅为声明的意图。Q3：相关，因为 Auto-review 是在动作层面代替人工批准的模型，但并非证据验收。H4：至多弱支持（厂商计划接入治理控制平面，未验证）。H1：弱支持，OpenAI 把评估结果作为发布产物公布，但这是厂商自己的发版证据。不足以改变论点置信度，将进入月度复查。
References参考文献
- OpenAI, “Introducing dots,” 2026-09-29. https://openai.com/index/introducing-dots/ company announcement · S-0018
- OpenAI Help Center, “Manage dots in ChatGPT workspaces,” read 2026-10-04. https://help.openai.com/en/articles/20001554-manage-dots-in-chatgpt-workspaces vendor documentation · S-0019
- OpenAI Help Center, “Dots privacy, security, and safety FAQs,” read 2026-10-04. https://help.openai.com/en/articles/20001529-dots-privacy-security-and-safety-faqs vendor documentation · S-0020
- OpenAI, “GPT-6 Astra System Card,” appendix on dots (sections 12.1 to 12.4), dots appendix added 2026-09-29. https://deploymentsafety.openai.com/gpt-6-astra/sec:appendix-dots-2 system card · S-0021
- Trębacz et al., “Auto-review of agent actions without synchronous human oversight,” OpenAI Alignment Research Blog, 2026-04-30 (Codex). https://alignment.openai.com/auto-review/ company research blog · S-0022
- OpenAI docs on dots (learn.chatgpt.com): overview, tasks and memory, computers and apps, controls, Enterprise admin guide; read via a summariser. https://learn.chatgpt.com/docs/dots vendor documentation · S-0023
Last updated 2026-10-04.