ChatGPT Work: Two Products Under One Name and a Tangled Set of Capabilities

OpenAI unveiled ChatGPT Work on July 9 and has been refining it nonstop ever since. Developer and researcher Simon Willison calls the product “extremely confusing, but very powerful” and shares what he's managed to figure out.

There are actually two products

Two different tools hide under a single name. “Work Cloud” runs in the cloud and is available through chatgpt.com and the mobile apps. “Work Local” appears once you install the desktop app (formerly Codex): it gains access to files and can run programs right on the user's computer, and is essentially a repackaged Codex for people who are scared of developer tools. Willison focuses on the cloud version.

Work is available only to paid subscribers starting at $20 a month; free users and the $8 Go plan don't have access. The author finds the official distinction between Chat and Work (“Chat is for answers and drafts, Work is for tasks with a concrete result”) useless, since he'd spent years doing all of that in ordinary Chat.

What Work can really do

Through experimentation, Willison put together a list of exclusive capabilities. The main one is a code-execution environment with internet access: unlike Chat, where calls to external sites and package installs are blocked, Work is open to all domains by default. You can clone repositories from GitHub, install dependencies, and work with any service. By comparison, the equivalent in Claude only allows a short list of permitted domains.

Another notable feature is a full-fledged headless Chrome browser. It loads pages, fills out forms, takes screenshots, and executes JavaScript in the DOM. If a site requires authorization, the browser prompts the user to enter their password and two-factor authentication code directly, without passing them through the model.

Work also gets a persistent file system shared across all sessions: the author has already accumulated 171 folders in his working directory. On top of this come publishing sites to Cloudflare Workers (with support for D1 and R2), launching sub-agents, and scheduled automatic prompts.

As for model selection, Work offers GPT-5.6 in the Sol, Luna, and Terra variants with reasoning levels up to Ultra. The author believes Work sessions are drawn from the Codex limit, whereas Chat has a separate limit.

Security in question

Willison notes that Work brings together all three components of his “lethal trifecta” concept: access to private data, exposure to untrusted content, and a channel for exfiltrating stolen information. How OpenAI protects sessions against prompt injections remains unclear.

The author's main complaint is that the company describes Work in terms of what it's for rather than what it does, and still hides the system prompts and tool descriptions. As a demonstration, Willison asked Work to build a catalog site of its own tools — there turned out to be 223 of them.

Source: Simon Willison