OpenAI's Dots agents struggle with permission boundaries as task chains grow

OpenAI unveiled Dots at its DevDay event on Tuesday—always-on autonomous agents that run continuously on dedicated cloud infrastructure, powered by GPT-6 Astra. Unlike traditional chatbots, these agents can monitor connected systems, move between tasks independently, and take action without waiting for user prompts. However, research surfaced a significant challenge: determining when an agent's authority to act on your behalf should stop.

The Permission Boundary Problem#

During internal testing, OpenAI discovered that permissions become increasingly unclear as Dots handle longer sequences of work. When the company extended a task chain from five operations to ten, the percentage of cases flagged for boundary violations more than doubled—rising from 8.6% to 19.7%. OpenAI published these findings in its GPT-6 Astra system card.

The core issue: what a Dot is permitted to do often shifts as it transitions between tasks, even without explicit new instructions from the user. The agent must infer its authority limits from business context, prior decisions, and OpenAI's policy guidelines. While testing identified no severe breaches or data theft, OpenAI declined to specify what those flagged violations entailed.

How Dots Are Supposed to Stay in Bounds#

OpenAI layered multiple safeguards into Dots' operation. During the initial proactive research phase, agents can examine connected applications but cannot modify them, dispatch messages, or control the user's browser or computer. This read-only mode limits the damage from indirect prompt injection attacks—where malicious instructions hide inside documents or tickets.

Once a Dot identifies work to handle, it shifts into an execution mode governed by built-in rules, custom rules, and automated review. The auto-review mechanism, adapted from OpenAI's Codex system, assigns a second model to scrutinize commands that run outside predefined boundaries. This oversight receives greater weight in Dots than in earlier implementations.

Permission Creep in Real Workflows#

Real-world use cases show how permission expansion happens naturally. OpenAI's example: a Dot monitors customer feedback, spots a minor bug, writes and tests a fix locally, then delivers a pull request to developers—all without human review of the interim work.