T1#launch#consumer#security

OpenAI Operator — An AI Agent That Runs Errands in Its Own Browser

The OpenAI logo on the OpenAI website in a browser, magnified through a hand-held magnifying glass
SourceJernej Furman (Wikimedia Commons) · CC BY 2.0 · View on Commons ↗

Metadata

Date
Decade
2020s
Tier
T1
Sources
07
Connections
03
Tags
#launch#consumer#security

Operator was an AI agent that OpenAI released as a research preview on 23 January 2025. Using its own browser, it looked at web pages and typed, clicked and scrolled to run errands for the user, such as filling in forms or ordering groceries. OpenAI called it one of its first agents, "AIs capable of doing work for you independently." At first it was available only to ChatGPT Pro subscribers ($200 a month) in the United States; it reached Japan and other regions about a month later, on 21 February 2025.

If you want a one-line answer to "what was Operator", it was the first consumer product to move from an AI that answers in chat to one that does things on the web. Its life as a standalone product was short: on 17 July 2025 it was folded into ChatGPT agent.

Release dates and regions

DateEventWho could use it
23 January 2025Operator released as a research previewChatGPT Pro users in the US
21 February 2025Wider rolloutPro users in Japan, Australia, Brazil, Canada, India, Singapore, South Korea, the UK and other places (the EU, Switzerland and some others excluded)
23 May 2025Underlying model switched from a GPT-4o version to an o3 versionSame
17 July 2025Folded into ChatGPT agent; standalone site closed a few weeks laterPro, Plus and Team (EEA and Switzerland pending)

Japan was not in the first wave. It was included in the expansion about four weeks after the US launch, which the Japanese site Mado no Mori reported on 25 February 2025.

How it worked: the Computer-Using Agent

Operator ran on a model called the Computer-Using Agent (CUA), which combined GPT-4o's ability to read images with reasoning trained through reinforcement learning. According to OpenAI, CUA was trained to handle graphical user interfaces, the buttons, menus and text fields people see on a screen, by looking at screenshots and acting through mouse and keyboard, just as people do. The point was that it needed no API integration for each website. The idea belongs to the same line as Claude's computer use, which Anthropic had released three months earlier.

BenchmarkCUA's scoreNote
OSWorld (full computer use)38.1%Humans: 72.4%
WebArena (simulated websites)58.1%OpenAI noted a remaining gap to human performance
WebVoyager (live websites)87%Mostly relatively simple tasks

All the figures are OpenAI's. The company also stated limitations: complex interfaces, such as creating slideshows or managing calendars, were still a struggle.

Safeguards: handing the reins back

An AI that really operates a browser can, if it errs, place a real order or send a real message. OpenAI's announcement set out several layers of safeguards.

  • A takeover mode for entering credentials or payment details, during which Operator does not collect or screenshot what the user types
  • Asking for approval before significant actions such as submitting an order or sending an email
  • Declining sensitive tasks such as banking transactions or high-stakes decisions like a decision on a job application
  • Requiring close supervision on sensitive sites such as email or financial services
  • A dedicated monitor model watching for instructions hidden in web pages (prompt injection)

OpenAI added that "no system is flawless and this is still a research preview."

Who gained, and what changed

OpenAI said it was working with DoorDash, Instacart, OpenTable, Priceline, StubHub, Thumbtack, Uber and others. Instacart's chief product officer, Daniel Danker, said it made processes like ordering groceries incredibly easy. With the City of Stockton in California, OpenAI explored making it easier to enrol in city services and programmes; where administrative procedures involve tedious screens, an agent could lighten the load on residents.

On the other hand, once AI visits sites on people's behalf, sites have to think about whether a visitor is a person or an AI. OpenAI kept going in this direction. On 29 September 2025 it announced Instant Checkout, letting users in the US buy directly from US Etsy sellers inside ChatGPT, and the Agentic Commerce Protocol, co-developed with the payments company Stripe. Commerce routed through AI agents extends what Operator was testing.

Folded into ChatGPT agent, then retired

On 17 July 2025 OpenAI announced ChatGPT agent, which merged Operator with deep research, its tool for researching and writing reports. OpenAI explained that many queries users attempted with Operator were actually better suited to deep research. ChatGPT agent worked on its own virtual computer, switching between a visual browser, a text browser and a terminal. Pro users got 400 messages a month and other paid users 40, and OpenAI chose to treat the model as having High capability in biology and chemistry, activating additional safeguards.

The standalone Operator site was closed a few weeks later. As of autumn 2026 OpenAI's help centre says ChatGPT agent itself is no longer available and recommends ChatGPT Work for longer tasks. Consumer browser agents have been replaced on a short cycle, changing name and shape as they go.

The first example that made the AI-agent idea popular is Auto-GPT; agents that write code are covered on the OpenAI Codex and Claude Code pages. For the start of ChatGPT itself see the launch of ChatGPT, and for the wider context the AI timeline and the AI and society timeline.

Questions this page answers

What was OpenAI Operator?
It was an AI agent OpenAI released on 23 January 2025 that looked at web pages in its own browser and typed, clicked and scrolled to complete tasks such as filling in forms or ordering groceries. It was powered by a model called the Computer-Using Agent (CUA).
When did it become available in Japan?
At launch it was limited to ChatGPT Pro users in the United States. On 21 February 2025 OpenAI extended it to Pro users in Japan, Australia, Brazil, Canada, India, Singapore, South Korea, the UK and other places; the EU and some other European countries were excluded at the time.
Is Operator still available?
No. It was folded into ChatGPT agent on 17 July 2025 and the standalone site was shut a few weeks later. As of autumn 2026 OpenAI's help centre says ChatGPT agent is no longer available either and points users to ChatGPT Work and other features.
What safeguards did Operator have?
A takeover mode that hands control to the user for credentials and payment details, confirmation before actions such as placing an order or sending an email, refusal of tasks such as banking transactions, close supervision on sites such as email and financial services, and a monitor model watching for prompt injection. OpenAI itself said no system is flawless.

Sources

  1. PrimaryIntroducing Operator — OpenAI, Jan 23, 2025

    Research preview for US Pro users; CUA; partner companies; the City of Stockton; safeguards; limitations; the 17 July 2025 update

    Accessed 2026-10-18

  2. PrimaryComputer-Using Agent — OpenAI, Jan 23, 2025

    OSWorld 38.1% (humans 72.4%), WebArena 58.1%, WebVoyager 87%

    Accessed 2026-10-18

  3. SecondaryOpenAIのAIエージェント「Operator」が日本でも提供開始 — 窓の杜, 2025年2月25日

    The 21 February 2025 expansion including Japan; Pro at $200 a month; the EU, Switzerland and others excluded

    Accessed 2026-10-18

  4. PrimaryIntroducing ChatGPT agent: bridging research and action — OpenAI, Jul 17, 2025

    Merger of Operator and deep research; rollout to Pro, Plus and Team; 400 messages a month on Pro and 40 on other paid plans; EEA and Switzerland pending; prompt-injection measures; treated as High capability in biology and chemistry

    Accessed 2026-10-18

  5. PrimaryChatGPT agent — OpenAI Help Center

    ChatGPT agent no longer available; users directed to ChatGPT Work and the cloud browser

    Accessed 2026-10-18

Last updated:

Share