OpenAI's first browser agent paused itself before purchases

The setup

On 23 January 2025, OpenAI introduced Operator, described in its own announcement as a research preview available to ChatGPT Pro subscribers in the United States. Rather than answering in text, Operator opens its own browser and looks at a page through screenshots, then clicks, types and scrolls, so it can fill out forms, order groceries or complete a checkout without a custom integration for each website. The announcement states Operator is powered by a Computer-Using Agent model combining GPT-4o's vision with reinforcement-learned reasoning. Using it for a task with real consequences, such as a purchase, meant accepting a workflow that pauses at defined points rather than finishing silently in the background.

What the documents show

OpenAI's announcement describes three safeguards: the model asks for input at critical points, a moderation system that can warn or revoke access for misuse, and defenses against adversarial webpages. The company's own Operator system card goes further, stating confirmations before consequential actions reduced the measured risk of a harmful mistake by approximately 90 percent versus a baseline without them. That is a self-reported figure from OpenAI's own red-teaming, not an independent audit, and it describes an internal risk metric rather than a plain success rate for everyday tasks.

The friction

The same system card discloses that Operator remains capable of what it calls model mistakes, including following instructions hidden in a webpage rather than the user's own request, a failure mode it names prompt injection. Its response is a mix of confirmations, a watch mode requiring close supervision on sensitive sites such as banking or email, and a takeover mode where a person types payment or login details directly so Operator never sees them. The announcement states Operator is trained to decline banking transactions and high-stakes decisions outright. None of this is framed as solved; the system card calls the agent still error-prone outside the browser environment it was mostly trained on.

What changed in the work

The documents support a narrower claim than an agent that shops unattended: Operator moved some browser tasks from typing it yourself to reviewing and approving, with the review step treated by OpenAI as the safety feature rather than friction to remove. That is an editorial reading of the setup cost — a person delegating a repetitive web task still has to stay near the keyboard for the confirmation. The announcement page's own July 2025 update states Operator was folded into ChatGPT's agent mode and the standalone site would sunset, a kept-or-dropped signal that the agent survived while the separate product did not.

• Does the task involve a site or action the agent's documentation says it will refuse or pause for?
• Is the confirmation step something a person will reliably see before an action completes?
• What does the vendor's own safety material say about the specific failure mode most relevant to this task?

Operator's paper trail is unusually candid for a product announcement: the risk-reduction figure and the prompt-injection disclosure both come from OpenAI's own testing, not a critic's. That candor is a reasonable floor for evaluating any agent asked to act rather than draft.