Understanding ChatGPT Work

TL;DR Highlight

ChatGPT Work adds internet-enabled code execution, full Chrome, and a shared filesystem beyond Chat

Who Should Read

A developer using LLM agents who is confused about when to use ChatGPT Chat versus Work

Core Mechanics

Work is actually two products
- Work Cloud runs in the cloud via chatgpt.com and mobile apps.
- Work Local is in the desktop app and accesses files and programs on your computer.
- The author thinks Work Local feels like Codex re-skinned for non-developers.
Work's value is features Chat lacks
- It has internet-enabled code execution, headless Chrome, and a filesystem shared across sessions.
- ChatGPT Sites publishing, sub-agents, and Sol/Luna/Terra model choice are also Work-only.
- Scheduled prompt automations turned out to work in Chat too, per the author's update.
Code execution has internet access
- Chat blocks package installs and external API calls at the container proxy.
- Work can be limited to an allowed domain list but appears open to all by default.
- You can clone GitHub repos, install dependencies, and use them against the web.
The browser is a full Chrome
- It loads sites, fills forms, takes screenshots, and runs JavaScript on the DOM.

Community Reactions

Chat and Work use different quotas
- Commenters say Work is billed against the Codex allowance while Chat has its own.
- One commenter said they need their full Codex budget, so Work is unusable for them.
- Another built a connector called Codexify to get a Codex environment inside Chat.
Real-world usage varies widely
- One user finished an email draft and a multistep travel authorization form in 5-10 minutes.
- Another builds Android APKs on a Pixel phone.
- Another uses the Work VM as a CI/CD runner.
Limits and corrections came up
- One user said Cloudflare blocked the browser from cancelling a phone subscription.
- Another said remote browser control froze after a few seconds.
- A commenter said Claude's cloud allowlist is customizable, correcting the article.
Security and lock-in concerns were raised
- One suggested a privacy boundary between the container agent and the chatbot agent for safety.

How to Apply

Have Work list its own tools
- In a fresh Work session, ask it to build a site documenting every tool with arguments and descriptions.
- Then ask it to add full copies of all skills.
- Paste the code example prompt.
Split tasks by feature, not by topic
- Send only tasks needing internet, a browser, sub-agents, or persistent files to Work.
- Keep simple answers and drafts in Chat to save Codex allowance.
Keep sensitive data out of Work sessions
- Assume an open-egress environment when giving connectors or files.
- Set an explicit allowed-domain list where possible to narrow exfiltration paths.
Make a trifecta checklist for your agents
- Check whether each agent has private data, untrusted input, and external communication.
- If all three overlap, decide which one to cut first.

Try It

copy & run

# Paste into a fresh ChatGPT Work session - the author's prompt from the article

Build a site that lists every one of your tools - neatly grouped into categories - and for each one explain what it does. Try to exactly duplicate arguments and tool descriptions where possible. Design aesthetic should be technical docs, minimal flare

# Next, send this follow-up once the site is built

Add full copies of every skill to the website (separate pages linked to from the homepage)

Terminology

lethal trifectaThe author's security model: an agent is dangerous when it has private data access, exposure to untrusted content, and a way to send data out.

Code Interpreter patternThe LLM writes and runs code in a sandbox and reads the results. It is like giving the model a calculator and a workbench.

Sub-agentA child agent session that a main agent delegates work to, like a lead handing tasks to teammates.

SkillA bundle of instruction documents the agent reads for a specific task, such as how to control the browser or create docx files.

Headless browserA browser with no visible window, driven by code. It is an invisible Chrome that clicks and types for you.