Simon Willison counted what ChatGPT Work actually has: 223 tools, 44 skills, open internet access

ChatGPT Work is two products under one name. Work Cloud runs on chatgpt.com and in the mobile apps, while Work Local is the desktop application that used to be called Codex. Willison's write-up of August 30, 2026 covers the cloud one. It took a write-up because OpenAI describes Work by what it is for, not by what it does.

What Work has that Chat does not

The two tabs present themselves as alternatives, and OpenAI's own guidance separates them by intent: Chat for an answer or a short draft, Work for a task with a clear outcome. Willison found that unhelpful, since he had been using Chat for exactly those categories of task for years. So he worked out the difference by feature instead.

Access is paid. Both versions go only to subscribers at $20 a month and above, while free accounts and the $8 a month Go tier are excluded. Inside Work the model list is GPT-5.6 in the Sol, Luna and Terra variants, plus GPT-5.5, each at several reasoning levels. Chat offers a different list, and its top two options are restricted to subscribers at $100 a month and above.

• Code execution that can reach the open internet, rather than a short list of permitted domains.
• A full headless Chrome that loads pages, fills forms, takes screenshots and runs JavaScript against the DOM.
• A scratch folder per session, on a filesystem that survives between sessions.
• Sub-agent sessions and the ability to publish sites through ChatGPT Sites, neither of which Chat offers.

Code with internet access, and a real browser

The code sandbox is the part Willison calls the most exciting, because it can talk to the rest of the internet. He reports that a list of allowed domains can be configured, but that the default appears to be open to everything. He contrasts this with Claude's container, where the allowlist is short: packages from PyPI and npm, repositories from GitHub, and not much beyond that.

The browser tool launches a full Chrome instance. Willison asked it to load his own site and pull out the headings with JavaScript, and it ran a Playwright evaluation against the DOM. When a page requires a login, the browser can hand control back to the person, so passwords and two-factor codes are typed in without passing through the model.

All three legs of the lethal trifecta in one product

Willison's own frame for agent risk is the lethal trifecta: access to private data, exposure to untrusted content, and a route for stolen information to leave. He states plainly that ChatGPT Work combines all three, and that he would like to hear from OpenAI how these sessions are defended against prompt injection. He expects the answer to be the same automatic review mechanism that Codex uses.

This suggests the inventory is the most useful thing to come out of the exercise. A filesystem shared by every running session, a browser that can be handed real credentials, and outbound network access with no meaningful limit on destination are three properties that each make sense alone and are hard to reason about together. None of it is documented by the vendor.