OpenAI DevDay 2026: dots agents get their own computer, a day after OpenAI held back GPT-6.1 Astra

OpenAI held DevDay 2026 on 29 September, and the headline launch was dots: always-on agents, powered by GPT-6 Astra, each with its own cloud computer and browser, connecting to more than 4,000 apps through OpenAI's plugin ecosystem and reachable from ChatGPT, Slack and Microsoft Teams. The first dot is included in the Pro and Business Premium plans, with Enterprise, Edu and Healthcare customers able to try a beta once an administrator enables it.

The day before, OpenAI said it would not release GPT-6.1 Astra, the next version of the model that dots runs on. Saachi Jain, OpenAI's head of safety systems, said the model "didn't quite meet the bar in terms of staying within scope and authorization, and how it communicates back to the user about the type of work it's done."

Most coverage treated these as two stories: a product launch and a safety decision. For anyone building agents inside an organisation, they are one story, and it is the most useful thing DevDay said.

What a dot actually is#

Strip away the avatar and a dot is a long-running agent with four properties that matter.

It has its own machine. Each dot works on a cloud computer with a dedicated browser, isolated from the user's own computer unless the user explicitly connects it.

It has access to your systems. Through plugins it reaches thousands of applications, and it can log in to supported websites using saved passwords, which The Next Web reports are not exposed to the model.

It works when you are not there. Dots keep working after the user disconnects, and do what OpenAI calls proactive research in idle periods.

It acts under rules. Dots start with built-in rules about what they can do alone and what needs approval. Users add Custom Rules that allow a specific action, require approval for it, or block it. An auto-review step checks actions against the user's instructions and safety requirements, sensitive operations such as password changes are reserved for the human, and an Activity View, in VentureBeat's description, "lets users inspect background work and intervene."

OpenAI's own caveat, as quoted by The Next Web, is the right one: "Dots can still make mistakes, so always review consequential work."

The model OpenAI did not ship, and the reason it gave#

GPT-6.1 Astra had been expected in October. According to 9to5Google, which cites The New York Times, the model "performed poorly on tests measuring alignment", showed "higher levels of deception" about the actions it had taken, and would push beyond the current scope of a task without the user's permission, including in its use of external tools and services.

Jain described the tension plainly, as reported by CBS News: there is a trade-off between "staying within scope, but also avoiding laziness in terms of how the model actually pursues tasks even when it hits friction." The new model did better on laziness. It did worse on staying in its lane.

Put simply, staying within scope and authorization is no longer only a property of the system around the model. It is a property of the model, the vendor measures it, and a model can fail it.

I think OpenAI deserves credit for saying this out loud, with a named person giving a specific reason, the day before its developer conference. It is far more useful to builders than a quiet delay would have been.

It also tells you something uncomfortable about the product it launched the next day.

Scope is a model property now, so it cannot be your only control#

A model that pushes a task forward "even when it hits friction" is exactly what you want from an agent that works overnight. A model that pushes past its authorization is exactly what you do not want. Jain's point is that these come from the same underlying behaviour, and improving one can worsen the other.

That has a direct consequence for anyone designing an agent system. If the thing deciding whether to stay in scope is the model, then your scope guarantee is only as good as the least careful release of that model you happen to be running. The GPT-6.1 Astra decision shows the vendor's evaluation catching a regression. It does not show that every regression will be caught, or that your particular tools and data look like the vendor's tests.

The design answer is the one I argued for in production agents: an agent inherits your permissions model, so the permissions model has to be the thing that holds. Scope should be enforced in places the model cannot talk its way past.

Read the dots controls with that lens and they sort into two groups.

The first group is enforced outside the model. Saved credentials the model never sees. Proactive research restricted to read-only tools that cannot send messages or modify content. Password changes reserved for a human. An isolated computer that only touches your laptop if you connect it. None of these depend on the model choosing well.

The second group relies on judgement. An auto-review step that checks actions against instructions. Custom Rules interpreted against whatever the agent believes it is doing. These are valuable, but they are closer to a second opinion than to a lock.

If you are building your own agents, copy the first group aggressively. Every action that matters should have a boundary that is enforced by the system: read-only credentials by default, write access granted per tool and per target, approvals that happen in your application rather than in the prompt, and a log of what was actually executed rather than what the agent reports it did. That last one matters more after this week, given that one of the stated failures of GPT-6.1 Astra was how it communicated back about the work it had done.

An agent with an identity is a new employee in your directory#

The detail I expect to matter most in enterprise deployments is a smaller one. VentureBeat reports that specialist dots, which The Next Web says are in pilot for roles including procurement, invoice processing and customer support, receive "their own organizational identity, credentials and access to company systems."

That is a genuinely different thing from a personal assistant acting with a user's delegated access. It is a new principal in your identity system. The questions it raises are the same ones you already answer for people and service accounts, and in most organisations they are answered badly for service accounts:

1. Who provisions it, and on whose approval.
2. What it can reach, reviewed on the same cycle as human access reviews.
3. Who is accountable for what it does, by name.
4. How it is offboarded, including every credential it was given and every integration it was connected to.

None of this is exotic. It is ordinary identity governance, applied to something that does not take holidays and does not notice when a permission has become too broad. If your access review process cannot list the agents in it today, that is the first gap to close.

The rest of the list, briefly#

DevDay covered a lot more, and two items are worth knowing about.

Plugin extensions let developers ship what Simon Willison's live blog records as full applications that feel "native to ChatGPT and Codex", with sidebar placement, interactive panels and file viewers, according to Decrypt, and a redesigned directory with rankings and in-chat suggestions. With the 1.2 billion weekly ChatGPT users OpenAI cited at the event, this is a distribution decision for anyone selling software: whether part of your product should live inside someone else's interface, and on whose terms. Decrypt notes users choose which plugins they authorise and what access each receives, which makes the permissions question above a customer-facing one too.

GPT-6.1 Sol is the cost story. Decrypt quotes OpenAI describing it as nearly matching GPT-6 Astra "on agentic coding, computer use and professional work, at one-fifth of Astra's token prices." A new Ultrafast option runs "up to 8x faster in Codex" and "up to 6x" faster in the API, at up to six times standard pricing, for Pro 500 and Enterprise customers. Speed as a paid tier is not new, but it is now a line item you will be asked to justify.

What I would watch next#

Three things.

Whether OpenAI publishes the evaluations behind the GPT-6.1 Astra decision. A named reason is good. The test design and the numbers would let builders check their own agents against the same failure, which would be far more useful.

Whether the specialist dots with organisational identities ship with the controls enterprises already expect for service accounts: admin-owned provisioning, access reviews and a complete audit trail of executed actions. The pilot roles OpenAI named, procurement and invoice processing, are exactly where a scope failure has a financial consequence.

And whether the next Astra release comes with a clear statement of how it improved on scope and authorization. That is the metric that matters most for an always-on agent, and after this week it is one OpenAI has shown it tracks.