ChatGPT Work Has 223 Tools and an Open Internet Sandbox
In this article
OpenAI announced ChatGPT Work on July 9th and has been iterating on it continuously since. Simon Willison published a detailed technical breakdown on August 30th that rewards close reading for any engineer evaluating enterprise AI tooling — the product's capabilities are substantially more powerful, and its security surface substantially larger, than OpenAI's own documentation suggests.
The first clarification Willison makes is architectural: ChatGPT Work is actually two distinct products sharing a name. Work Local runs inside the ChatGPT desktop app (formerly Codex), giving the model direct access to the local filesystem and process environment. Work Cloud runs at chatgpt.com and in the mobile apps. Both variants are gated behind paid tiers: the $20/month plan is the entry point; free users and $8/month Go subscribers have no access. The rest of Willison's analysis — and this article — concerns Work Cloud exclusively.
What Work Cloud Adds Over Chat
After extensive experimentation, Willison catalogued the concrete feature delta:
- A code execution environment with unrestricted outbound internet access by default, configurable to a domain allowlist
- A full headless Chrome instance running via Playwright, capable of loading pages, filling forms, executing arbitrary JavaScript against the DOM, and taking screenshots
- A persistent shared filesystem where each session receives its own scratch folder (e.g.
/workspace/scratch/e00a0a017944) that persists across sessions — Willison reports 171 such folders in his account, all mounted to the/workspacevolume simultaneously; edits in one running session are instantly visible to others - The ability to deploy ChatGPT Sites to Cloudflare Workers, with support for HTML, JavaScript, server-side logic, and stateful backends on Cloudflare D1 and R2
- Sub-agent orchestration using Sol, Luna, and Terra models in parallel
- Scheduled prompt automations that trigger recurring tasks and conditionally notify the user
Scheduled automations compose with other Work-exclusive features — for example, scheduling a ChatGPT Site rebuild on an hourly cadence.
ChatGPT Chat, by contrast, offers no persistent filesystem across sessions, no internet-connected code execution, no headless browser, and no sub-agent delegation.
Model Selection and Billing
| Interface | Models Available | Reasoning Levels | Notes |
|---|---|---|---|
| Work Cloud | GPT-5.6 Sol, Luna, Terra; GPT-5.5 | Light, Medium, High, Extra High, Max, Ultra (5.6); Light, Medium, High, Extra High (5.5) | Ultra more aggressively delegates to sub-agents; billed against Codex allowance |
| ChatGPT Chat ($20/mo) | GPT-5.6 Instant, Medium, High; Extra High and Pro gated to $100/mo+ | Instant through High for $20/mo subscribers | 5.6 Pro appears exclusive to Chat; Sol/Luna/Terra variant not disclosed to users |
Work sessions draw from the Codex usage allowance rather than the Chat allowance — a billing separation that likely explains the differing model menus. The GPT-5.6 Sol, Luna, and Terra designations correspond to the same models exposed through the OpenAI API.
223 Tools and 44 Skills
To enumerate the full capability footprint, Willison prompted a fresh Work session to build a reference site listing every available tool. The result catalogued 223 registered tools — 6 of which came from his own personal MCPs served via datasette-mcp. The headless browser capability does not appear as a top-level tool; it is implemented as a skill called control-browser. Work Cloud uses 44 skills in total.
The control-browser skill exposes the browser through a browser-client runtime via the agent.browsers.* API, and requires the agent to call await browser.documentation() before interaction. Other notable skills include: documents for generating .docx files, pdf for reading and rendering PDFs, spreadsheets for .xlsx/.xls/.csv/.tsv manipulation, imagegen, sites:sites-building, openai-docs for self-referential queries, and data-analytics:build-dashboard.
Prompt Injection and the Lethal Trifecta
Willison raises an explicit security concern using his "lethal trifecta" framework: any agent system that simultaneously holds access to private data, processes untrusted external content, and possesses an exfiltration channel creates a high-risk attack surface. Work Cloud satisfies all three conditions. The persistent shared filesystem means data written in one session is accessible to all concurrently running Work sessions. The internet-connected code execution environment and headless browser both constitute exfiltration paths. The credential-handling mechanism — where the browser can pause and prompt the human to enter passwords and 2FA codes without those values passing through the model — mitigates one vector, but the broader prompt injection exposure remains unaddressed in OpenAI's public documentation.
This risk profile is a structural property of capable agentic systems, as the pattern of agent control layers operating without a shared security contract illustrates across the industry. The Sentry key hijack incident is a concrete precedent for what happens when agentic systems with broad tool access meet adversarial inputs in production.
The gap between Chat and Work is not cosmetic but architectural. For teams evaluating enterprise AI integration, the persistent filesystem, open-internet code execution, and 44-skill browser automation stack represent a fundamentally different threat and capability model than a stateless chat API. That a third-party researcher had to reverse-engineer a 223-tool manifest by prompting the system to document itself points to a transparency gap that enterprise security reviews will need to account for independently.