OpenAI's ChatGPT Work, launched July 9th and available to $20/month+ subscribers, is far more powerful than most users realize. Developer Simon Willison has published the most thorough breakdown yet, revealing features that transform it from a chatbot into a full development environment.
The biggest revelation: ChatGPT Work's code execution environment has open internet access by default. Unlike ChatGPT Chat, which blocks external API calls, Work can clone GitHub repos, install packages, and interact with any website. It also runs a full headless Chrome browser that can fill forms, take screenshots, and execute JavaScript against live DOMs.
Work sessions get persistent filesystems shared between sessions — Willison counts 171 scratch folders in his workspace. It can build and deploy entire websites via Cloudflare Workers, run sub-agent sessions with different models (Sol, Luna, Terra), and schedule recurring prompt automations.
Willison flags serious safety concerns: Work combines access to private data, exposure to untrusted content, and communication channels — his "lethal trifecta" of agent risk. He notes OpenAI hasn't explained how it protects against prompt injection attacks in this environment.