> My lethal trifecta model warns about the risks inherent in any agent system that combines access to private data with exposure to untrusted content and a way to communicate stolen information back to an attacker.
> ChatGPT Work combines all three!
The ChatGPT Work model would actually feel safer to me if they created a privacy boundary between the container-managing agent (browser operator/VM manager/code runner/etc) and the chatbot agent. Instead of me not typing privacy-sensitive things to the chatbot to avoid having them in my history, the chatbot would keep my history private from the container agent except on a need-to-know basis. That would remove the "access to private data" from the container's trifecta.
Not perfectly safe of course, just safer. Particularly if I could review the logs between the two agents.
I think most people are sleeping on the ChatGPT Work/Codex computer use feature. It's incredibly useful. I can remote in from the app, voice it instructions, then let it work in the background. When I tell it "draft a reply to this email (which it has access to thru the gmail connector) and attach the latest docs" or "fill out this multistep immigration electronic travel authorisation form using my passport files saved in the folder", it just asks for the relevant info and handles the rest. It opens its internal web browser and programmatically fills out the forms.
It gets the task done in 5-10 minutes. It's it bit slow since I'm not paying extra for ultrafast mode, but it gets the job done. Frees up the brain to do other tasks.
It's exactly like vibe coding but for computer tasks.
I am not sure I understand how this is better from using Claude Code from the mobile app.
Or Codex from the ChatGPT app.
If you have supplied tooling on your system, you have access to all of this and more.
I think the idea is most people don’t have a machine up and available, nor maintain skills for interacting with their core services?
One thing that keeps me from adopting codex more deeply is the architecture around mobile access.
Claude Code makes this trivial /rc and you are done.
Codex requires you run the desktop app and additional authentication requirements. The result of this has been codex is almost always relegated to fleet worker rather than orchestrator.
I wonder if the emphasis on this work feature has something to do w the persistent hurdles to remote control if codex sessions.
> "fill out this multistep immigration electronic travel authorisation form using my passport files saved in the folder"
It's both awesome and scary at the same time to realising that most AI these days can work on something like this that's official and tedious, and probably not screw up too much (or do better at it than some people with fat fingers).
And that is exactly why AI marketing touts ability to replace programmers, when in reality it is much better suited to replace middle management between client and programmers...
Codex in ChatGPT Desktop + 5.6Sol is my daily driver for non-coding things, and it's great. FWIW, I've not explored what differentiates Codex and Work modes- Simon notes that Work 'feels more like regular Codex re-skinned'. OpenAI seems to say that they're 'optimized' for SWDev and general knowledge work respectively, but reading between the lines- I suspect that yes, this boils down to a reskin.
I have been of the opinion for the last 6 months that this product category* is going to be something that sticks. I really think that OpenAI and Anthropic have totally dropped the ball on getting their respective desktop apps in front of the enterprise business user cleanly. Both jumped early, and tried to retroactively fix their jump by combining MVP (Work, Cowork) into their existing app.
By now, my suspicion is that the business user has baked into their mind 'that claude thing is just the chat app I copy-paste stuff out of, it was kinda annoying'. OAI+Ant really need to reset, and shamelessly relaunch ChatGPT/Claude Desktop as a new product- and market the hell out of it as some shiny new solution to everything.
I'll also say that MCP was (considering stateless now) a massive mistake. Not that MCP doesn't have it's niche, but it completely dominated the airwaves of AI for enterprise. People found it confusing, and it wasn't adopted by biglabs in a low-friction way. I recall distinctly late last year, neither had a client that would support local MCP servers- even though the buzz was peaking. And now, Anthropic still doesn't have great support- their OAuth flow is straight up broken, and they even collide with MCP using their own terminology (connectors)- which overlaps in a very weird way with built-in and 3rd party connectors. It's all very weird, and very anti-enterprise. I don't know where OAI is positioned on MCP support, because my userbase is 99.5% Anthropic rideordie, and I don't want to live with a client I can't manage**.
* That being desktop app for harness with shell tool + scheduling + agent-per-project/directory. At some point within that 6 months I've also lumped in browser use, and to a lesser extent, computer use, as must-have features.
** Referring to the MCP client ChatGPT Desktop uses. It's probably fine, but if I hit API direct, I can actually control how the harness facilitates the calls. Look how many GH Issues there are for MCP client things on OAI's end.
I agree on the shotgun marriage of the various modes. It was super disconcerting, as a Claude desktop user, to get a sudden redesign and push to something I will never use on my personal laptop.
Also Big +1 that they need to do a clean launch, marketing push, etc. Even if it is just a reskin, having dedicated branding, a strong privacy promise, random vague-posted fluff around "enterprise-ready", and a "Contact Us" pricing that gets you SSO for $150/u/mo. There is too much baggage with the chat app.
I feel the same using Claude Code on mobile. Or Claude Design, which has to go through mobile safari. Give me an app whose interface is optimized for product/dev. Yes, I should be able to do anything on each, but I have specific needs in different contexts. That's what "products" are.
I recently figured out that I could use ChatGPT Work on my Pixel Phone to build native Android apps. It builds the app and you can then directly download/install the APK. So now I just build small utility apps on-the-go whenever I need them :)
Which I created using this prompt in a fresh Work session:
> Build a site that lists every one of your tools - nearly grouped into categories - and for each one explain what it does. Try to exactly duplicate arguments and tool descriptions where possible. Design aesthetic should be technical docs, minimal flare
UPDATE: I had it add all of the available skills too. This solved a mystery: I didn't see a tool for controlling the headless browser. It turns out that's handled by a skill that tells is how to run the browser via its Node.js REPL tool: https://codex-tool-reference.simonw.chatgpt.site/skills/cont...
Wow. For what it's worth, I ran that prompt in Codex mode in ChatGPT Desktop (sans-site artifact), and I ended up with the below. This is on a default setup, win10.
- *9 top-level orchestration tools*: the `functions.` and `collaboration.` calls available directly to the model.
- *83 operations inside `functions.exec`*: these appear on its global `tools` object.
- *92 callable tools/operations total* under that counting method.
- *10 execution helpers* inside `functions.exec` documented separately at the end. They are helper functions, not independent tool calls.
It’s been part of the strategy from both OpenAI and Anthropic to split users into “devs” and “knowledge workers”. Hence Codex and Work (or Claude Code vs Cowork), and Chat is stuck in between. Codex can do everything Work can do and most non devs I know use Codex - from sales ppl doing weekly prioritisation of pipelines and customised email reach outs, to project managers using it as a living LLMWiki of all the projects and teams. In fact the biggest shift in business I’ve seen is the embrace of coding agents as defacto AI tool across knowledge workers.
ChatGPT work usage counts toward Codex entitlement
Some people have an agent-driven browser that controls the ChatGPT web UI and exposes it as a chat view in a custom harness or pi for normal chats (with image generation, file input capability).
Great article. I will add that Extra High and Pro levels of work are available in ChatGPT for Teams ($25 USD/seat, min 2 seats); not just the $100+ tier.
Not for long. Too late to get Business now to exploit this, since EH and the small credit-free Pro allowance will soon be restricted to Premium Seats ($100/m).
> I believe ChatGPT Work sessions are billed against your Codex allowance, while ChatGPT Chat Sessions get their own, separate allowance. This may help explain the model availability differences
That's correct, and also why ChatGPT Work is DOA for me personally.
I need 100% of my Codex budget for Codex.
Too bad, it would have been nice to have a few extra features for the chat interface.
I thought they just did this? People were using some loophole to use their Chat sessions to power their Codex usage after their Codex quotas had run out.
Similarly, I use my budget with Shelley on exe.dev. But it seems nice that as far as I can tell, for ChatGPT usage, coding agents compete on a level footing.
I still might try ChatGPT Work sometime if there was some feature I couldn't get from Shelley.
Work is for heavy work that runs in the background. It can make a hundred slide deck for me with speaker notes and visual verification of each slide, all without breaking a sweat. See my gist ac89399e688ab5c85ad021f091606e36 for the skill.
The things it can't do is use the embedding or TTS models as a part of its quota, which is sad. It also cannot read a video.
> OpenAI could make this a lot less confusing
> Figuring this all out took way more work than it should have.
Welcome to a generic large corporation, where they spend billions on making a product, and $0 on checking if the product makes any sense to a real user.
> My lethal trifecta model warns about the risks inherent in any agent system that combines access to private data with exposure to untrusted content and a way to communicate stolen information back to an attacker.
> ChatGPT Work combines all three!
The ChatGPT Work model would actually feel safer to me if they created a privacy boundary between the container-managing agent (browser operator/VM manager/code runner/etc) and the chatbot agent. Instead of me not typing privacy-sensitive things to the chatbot to avoid having them in my history, the chatbot would keep my history private from the container agent except on a need-to-know basis. That would remove the "access to private data" from the container's trifecta.
Not perfectly safe of course, just safer. Particularly if I could review the logs between the two agents.
I think most people are sleeping on the ChatGPT Work/Codex computer use feature. It's incredibly useful. I can remote in from the app, voice it instructions, then let it work in the background. When I tell it "draft a reply to this email (which it has access to thru the gmail connector) and attach the latest docs" or "fill out this multistep immigration electronic travel authorisation form using my passport files saved in the folder", it just asks for the relevant info and handles the rest. It opens its internal web browser and programmatically fills out the forms.
It gets the task done in 5-10 minutes. It's it bit slow since I'm not paying extra for ultrafast mode, but it gets the job done. Frees up the brain to do other tasks.
It's exactly like vibe coding but for computer tasks.
I am not sure I understand how this is better from using Claude Code from the mobile app.
Or Codex from the ChatGPT app.
If you have supplied tooling on your system, you have access to all of this and more.
I think the idea is most people don’t have a machine up and available, nor maintain skills for interacting with their core services?
One thing that keeps me from adopting codex more deeply is the architecture around mobile access.
Claude Code makes this trivial /rc and you are done.
Codex requires you run the desktop app and additional authentication requirements. The result of this has been codex is almost always relegated to fleet worker rather than orchestrator.
I wonder if the emphasis on this work feature has something to do w the persistent hurdles to remote control if codex sessions.
> "fill out this multistep immigration electronic travel authorisation form using my passport files saved in the folder"
It's both awesome and scary at the same time to realising that most AI these days can work on something like this that's official and tedious, and probably not screw up too much (or do better at it than some people with fat fingers).
Less bureaucracy should be the focus of AI marketing, rather than global superintelligent robots or smut generation
Bureaucracy is a major part of many corporate leader’s roles. That might not be the best sales line
And that is exactly why AI marketing touts ability to replace programmers, when in reality it is much better suited to replace middle management between client and programmers...
Lets just not redo subscription gods
agreed on the notion that
> people are sleeping on the ChatGPT Work/Codex
just in general. I find it to be far superior (imo) for all tasks atm. Claude just overdoes things in writing, coding, architecture, etc
Maybe for the occasional something. If I had an actual workflow i'd prefer a dedicated tool over the newest chatgpt "do everything" app.
Sol Light on computer use is fantastic. I use it whenever I need to dive deep into whatever shitty web saas app menu if the API is unavailable
Codex in ChatGPT Desktop + 5.6Sol is my daily driver for non-coding things, and it's great. FWIW, I've not explored what differentiates Codex and Work modes- Simon notes that Work 'feels more like regular Codex re-skinned'. OpenAI seems to say that they're 'optimized' for SWDev and general knowledge work respectively, but reading between the lines- I suspect that yes, this boils down to a reskin.
I have been of the opinion for the last 6 months that this product category* is going to be something that sticks. I really think that OpenAI and Anthropic have totally dropped the ball on getting their respective desktop apps in front of the enterprise business user cleanly. Both jumped early, and tried to retroactively fix their jump by combining MVP (Work, Cowork) into their existing app.
By now, my suspicion is that the business user has baked into their mind 'that claude thing is just the chat app I copy-paste stuff out of, it was kinda annoying'. OAI+Ant really need to reset, and shamelessly relaunch ChatGPT/Claude Desktop as a new product- and market the hell out of it as some shiny new solution to everything.
I'll also say that MCP was (considering stateless now) a massive mistake. Not that MCP doesn't have it's niche, but it completely dominated the airwaves of AI for enterprise. People found it confusing, and it wasn't adopted by biglabs in a low-friction way. I recall distinctly late last year, neither had a client that would support local MCP servers- even though the buzz was peaking. And now, Anthropic still doesn't have great support- their OAuth flow is straight up broken, and they even collide with MCP using their own terminology (connectors)- which overlaps in a very weird way with built-in and 3rd party connectors. It's all very weird, and very anti-enterprise. I don't know where OAI is positioned on MCP support, because my userbase is 99.5% Anthropic rideordie, and I don't want to live with a client I can't manage**.
* That being desktop app for harness with shell tool + scheduling + agent-per-project/directory. At some point within that 6 months I've also lumped in browser use, and to a lesser extent, computer use, as must-have features.
** Referring to the MCP client ChatGPT Desktop uses. It's probably fine, but if I hit API direct, I can actually control how the harness facilitates the calls. Look how many GH Issues there are for MCP client things on OAI's end.
I agree on the shotgun marriage of the various modes. It was super disconcerting, as a Claude desktop user, to get a sudden redesign and push to something I will never use on my personal laptop.
Also Big +1 that they need to do a clean launch, marketing push, etc. Even if it is just a reskin, having dedicated branding, a strong privacy promise, random vague-posted fluff around "enterprise-ready", and a "Contact Us" pricing that gets you SSO for $150/u/mo. There is too much baggage with the chat app.
I feel the same using Claude Code on mobile. Or Claude Design, which has to go through mobile safari. Give me an app whose interface is optimized for product/dev. Yes, I should be able to do anything on each, but I have specific needs in different contexts. That's what "products" are.
I recently figured out that I could use ChatGPT Work on my Pixel Phone to build native Android apps. It builds the app and you can then directly download/install the APK. So now I just build small utility apps on-the-go whenever I need them :)
I just updated the article to link to this site: https://codex-tool-reference.simonw.chatgpt.site/
Which I created using this prompt in a fresh Work session:
> Build a site that lists every one of your tools - nearly grouped into categories - and for each one explain what it does. Try to exactly duplicate arguments and tool descriptions where possible. Design aesthetic should be technical docs, minimal flare
UPDATE: I had it add all of the available skills too. This solved a mystery: I didn't see a tool for controlling the headless browser. It turns out that's handled by a skill that tells is how to run the browser via its Node.js REPL tool: https://codex-tool-reference.simonw.chatgpt.site/skills/cont...
Wow. For what it's worth, I ran that prompt in Codex mode in ChatGPT Desktop (sans-site artifact), and I ended up with the below. This is on a default setup, win10.
- *9 top-level orchestration tools*: the `functions.` and `collaboration.` calls available directly to the model. - *83 operations inside `functions.exec`*: these appear on its global `tools` object. - *92 callable tools/operations total* under that counting method. - *10 execution helpers* inside `functions.exec` documented separately at the end. They are helper functions, not independent tool calls.
It’s been part of the strategy from both OpenAI and Anthropic to split users into “devs” and “knowledge workers”. Hence Codex and Work (or Claude Code vs Cowork), and Chat is stuck in between. Codex can do everything Work can do and most non devs I know use Codex - from sales ppl doing weekly prioritisation of pipelines and customised email reach outs, to project managers using it as a living LLMWiki of all the projects and teams. In fact the biggest shift in business I’ve seen is the embrace of coding agents as defacto AI tool across knowledge workers.
ChatGPT work usage counts toward Codex entitlement
Some people have an agent-driven browser that controls the ChatGPT web UI and exposes it as a chat view in a custom harness or pi for normal chats (with image generation, file input capability).
I became a pelican fan, thanks to Simon. Looks like Simon keeps thinking about pelicans each time he prompts to any LLM. :)
Great article. I will add that Extra High and Pro levels of work are available in ChatGPT for Teams ($25 USD/seat, min 2 seats); not just the $100+ tier.
Not for long. Too late to get Business now to exploit this, since EH and the small credit-free Pro allowance will soon be restricted to Premium Seats ($100/m).
There is more to the browser, it can give you a remote desktop access to the browser.
So it's not completely headless.
But when I tried it, the remote control completely froze after a few seconds.
Understanding ChatGpt Retirement
—
> I believe ChatGPT Work sessions are billed against your Codex allowance, while ChatGPT Chat Sessions get their own, separate allowance. This may help explain the model availability differences
That's correct, and also why ChatGPT Work is DOA for me personally.
I need 100% of my Codex budget for Codex.
Too bad, it would have been nice to have a few extra features for the chat interface.
If we voice this opinion publicly, the most likely end result is that OpenAI will start billing our chat sessioms against our Codex budget too.
I thought they just did this? People were using some loophole to use their Chat sessions to power their Codex usage after their Codex quotas had run out.
No, it's still separate. I don't know what that exploit was though, so possibly they just patched that.
Similarly, I use my budget with Shelley on exe.dev. But it seems nice that as far as I can tell, for ChatGPT usage, coding agents compete on a level footing.
I still might try ChatGPT Work sometime if there was some feature I couldn't get from Shelley.
Work is for heavy work that runs in the background. It can make a hundred slide deck for me with speaker notes and visual verification of each slide, all without breaking a sweat. See my gist ac89399e688ab5c85ad021f091606e36 for the skill.
The things it can't do is use the embedding or TTS models as a part of its quota, which is sad. It also cannot read a video.