What Simon Willison found inside ChatGPT Work

OpenAI announced ChatGPT Work on July 9, positioning it as the task-completion counterpart to ChatGPT Chat. Developer Simon Willison has tested the product directly. His central observation: Work is not one feature but a bundled agent platform, and OpenAI's own descriptions make its actual capabilities hard to pin down.

Work ships in two forms. The cloud version, reachable through chatgpt.com and the mobile apps, is the one with the most new machinery. The ChatGPT desktop app—formerly Codex—offers a local variant that can access files and run programs on the user's machine, which Willison describes as Codex re-skinned to be less intimidating to non-developers. Both are limited to subscribers paying $20 a month or more; free and $8 Go tiers get nothing.

Willison's experimentation turned up several capabilities that distinguish Work from ordinary ChatGPT. The most significant is a code execution environment with real internet access. ChatGPT Chat's container blocks outbound connections and package installation; an earlier ability to install packages appears to have regressed, he notes. Work, by contrast, can clone GitHub repositories, install dependencies, and talk to outside services. The default domain policy appears open to everything, unlike Claude's code interpreter, which has allowed restricted internet access since last September but only to a short allowlist.

The built-in headless Chrome browser is similarly broad. It can load pages, fill forms, take screenshots, and run JavaScript against the DOM, and it can hand control to the user for passwords and two-factor codes without passing credentials through the model. Willison demonstrated the setup by having Work extract headings from his own site with a Playwright script.

Other features Willison tested include a persistent filesystem shared across sessions—including instantaneous file visibility between concurrently running sessions, though localhost servers stay isolated—website publishing on Cloudflare Workers with stateful D1 and R2 storage, parallel sub-agent sessions, and scheduled prompt automations, which he says now also work in regular Chat. Model selection differs as well: Work offers GPT-5.6 Sol, Luna, and Terra with reasoning up to Ultra, while Chat has a 5.6 Pro option with no Work equivalent. Willison suspects Work sessions draw on the Codex allowance but presents that as his working hypothesis, not a confirmed detail.

His biggest unresolved question is safety. Work combines access to private data, exposure to untrusted content, and a way to communicate information back to an attacker—the "lethal trifecta" he uses to frame agent risk. OpenAI, he says, has not explained how Work sessions defend against prompt injection; he expects the same auto-review mechanism used by Codex but has not seen it confirmed.

The documentation gap irked him enough that he asked Work to describe itself. The resulting site lists 223 registered tools—six of which are Willison's own MCP plugins—and 44 skills, including a control-browser skill that documents the browser API in detail. That the agent's own tooling had to be interrogated to reveal its contents is the most concrete takeaway: OpenAI describes Work in terms of intended use cases, and the underlying mechanics remain opaque.