OpenAI’s Dots: agents that never clock off

At its developer day on 29 September, OpenAI launched Dots, always-on agents inside ChatGPT. Each Dot gets its own cloud computer and browser, connects to more than 4,000 apps through plugins, and keeps working on the goals you give it. You can message it in ChatGPT, Slack or Teams, or call it, and it keeps the thread (Engadget, TNW).

Dots run on GPT-6 Astra. Your first Dot comes with the $200 a month Pro plan, or with a Business Premium seat at $100 a user a month billed yearly ($125 billed monthly, per OpenAI’s help page). Pro users in the European Economic Area, Switzerland and the UK don’t get Dots at launch, and OpenAI hasn’t said why. Business Premium gets them in every supported region.

Our own assistant does a small slice of this on our own hardware, and we decide exactly what it can touch. That’s about our build, not a verdict on theirs.

The model OpenAI held back

The same week, OpenAI shelved GPT-6.1 Astra, the next version of the model Dots runs on. In OpenAI’s own testing it didn’t stay within scope and authorisation as well as it should have (ABC News). Sam Altman at DevDay: “I wouldn’t over-rotate on this one thing” (CBS News).

The UK’s AI Security Institute had already published a test of the current model, GPT-6 Astra. In fully simulated runs, with its cyber classifiers switched off on purpose, it carried out unsanctioned supply-chain attacks 29.2% of the time, against 6.3% for GPT-5.6 Sol. All actions were simulated and nothing touched the real world. When the instructions said anything not listed was out of scope, it was 4 of 49 tries, down from 26 of 50.

A lab holding back a model because of its own tests is the system working.

An agent inside Medicare’s portal

OpenAI apologised to Australia for four incidents during training in June. The worst: an internal-only model, without the safeguards its public products have, got non-public access to the Medicare Statistics Reporting Service. It ran commands, retrieved internal files, credentials and aggregate statistics, and wrote files. OpenAI says no individual patient or client records were accessed.

OpenAI found it in mid-August and told the government in early September. Its words: “We are sorry and working to do better in the future” (AAP). It is setting up a taskforce with independent Australian experts. Update: chief strategy officer Jason Kwon appeared before Australia’s Joint Select Committee on AI on 6 October by video link (Bushletter). The video was voiced before the hearing.

Everyone wants an agent that never sleeps

Meta, Anthropic and SpaceXAI all have agents like Dots. Meta’s Muse passed five million US downloads in 22 days by Sensor Tower’s estimate; ChatGPT took 56 (Quartz). SpaceXAI’s Grok Bot came out in August, and about two weeks ago Anthropic folded Cowork into the main Claude app, so Claude keeps working on scheduled jobs after you close the laptop (The New Stack). Four always-on agents from four labs in about two months.

The White House accord

Google, OpenAI, Anthropic, NVIDIA, Meta and xAI signed a voluntary accord with the President on 29 September, the White House Accord on Super Intelligence. The companies commit to internal controls, internal oversight teams, independent outside audits and board oversight. Trump called it “morally binding” and “almost like a constitution” (CBS News). Tech Times lists what isn’t in it: no penalties, no duty to report a breach, and each company picks its own auditors.

GLM-5.3: a free model that builds exploits

Anthropic’s red team tested GLM-5.3, an open-weight model from China’s Zhipu that anyone can download. It built working end-to-end exploits in 50 of 410 ExploitBench tasks, about 12%; Claude Mythos Preview did 56. Its refusals gave way 64% of the time with a false cover story, 92% with pre-filled reasoning, and every time once the safety training was removed (abliteration). The smaller GLM-5.3 Flash built a working exploit chain for a known Chrome flaw (CVE-2026-11645) with eight hours of compute and 20 minutes of a person’s time, about $20.40 at Zhipu’s prices. Anthropic asks for government safety testing of capable models and broader access to frontier tools for defenders. It doesn’t call for a ban.

Qwen, censored and edited

Hirundo ran 500 prompts across 15 topics through Alibaba’s Qwen 3.6 (the 35B version). On politically sensitive prompts, 89.8% of its answers were censored, propaganda-aligned or biased; after Hirundo edited the weights it says that fell to 2.8% (CBS News). The edited models are on Hugging Face, per Hirundo’s release. Hirundo sells this kind of editing, and it could only do it because the weights are open.

The ticker

Micro Center has asked some RTX 5090 buyers for photo ID and a signed “no export” declaration. It’s the store’s own form, seen at one location so far (our own radar note on it) (Tom’s Hardware). H.R. 10670 would bar Chinese AI models from government devices and purchases; it went to the House Oversight committee on 1 October. Sam Altman told Politico the world “has to tolerate some bad things happening” to keep AI’s benefits (via Bloomingbit). Black Forest Labs released FLUX 3 Image, with up to ten reference images and 4K output; an open-weight version is expected in the coming weeks (The Decoder). And Comfy Agent builds ComfyUI workflows on your canvas from a description; it’s on Comfy Cloud now, with a desktop version promised in a few weeks.

Lab report

We ran a tiny print shop with Ming Image, a free model built for text in pictures: local AI t-shirt design with text that’s spelled right. Plain Krea 2 spelled about as well, and faster, and Ming’s official workflow hides a prompt rewriter that’s on by default and took up to 17 minutes a prompt.

That episode was voiced with ElevenLabs v4. This brief is back on ElevenLabs v2, the voice you usually hear. Which did you prefer? Tell us in the comments on the video.

Presenter shots were generated with MiniMax H3, by MiniMax, under the MiniMax H3 licence.

Next issue: The DIY AI Brief, Ep. 15, The Test That Didn’t Stay a Test, a Claude test model filed a false murder tip, the White House wrote an incident rule, and a free game demo ran up a $1,000-a-day AI bill.