Two modes, two very different grants

The split between Chat and Work is the whole story, and the announcement's headline blurs it.

Chat is a reader. It looks across the tabs you already have open and answers from them. That removes the copy-paste step from comparison work. Do not mistake it for the exposure of pasting a page into a chat yourself: when you paste, you choose the text. A reader across all your open tabs takes in whatever those pages contain — including the ones you forgot were open — and it exposes that content even when it takes no action at all.

Work is an actor. It clicks, types, sends and downloads inside tabs where you are already signed in. OpenAI's own documentation names LinkedIn, Salesforce, Gmail and internal tools as the kind of sites in reach. A reader can leak what it sees. An actor can do things with your accounts. Those are different risk decisions, and they arrive in the same extension update.

The permission screen is the product

To OpenAI's credit, the default is not silent access. Three separate controls are in play, and they are worth keeping distinct. The first is the install-time permission grant to the extension itself. The second is the per-website approval: the documentation says ChatGPT asks before interacting with each new website, by host, and the choices are Allow once, Allow for this site, Allow for all sites, or Decline. The third is ChatGPT's own confirmations during a task — OpenAI's documentation is explicit that the extension's install permissions do not replace its confirmations, settings, allowlists and blocklists before it uses a website or your history. Allow for all sites waives the second control, the per-site prompt. It does not waive the third.

Allow for all sites is labelled Elevated Risk in OpenAI's own documentation. So is browser-history access, and the two differ in a way that matters. A site permission persists until you revoke it. History access is scoped to the individual request and has no always-allow setting. They also expose different things: your open tabs are what you are looking at now, while your history is a record that, as OpenAI's documentation notes, can include sensitive telemetry, internal URLs and search terms from your signed-in devices.

Read those labels as the honest part of the launch. The install-time permission list is broad — reading and changing data on all websites, browsing history across signed-in devices, bookmarks, downloads, tab groups, debugger access — which is normal for a browser agent and still worth saying out loud before you click install. The store listing adds two narrower promises: ChatGPT works in the background without taking over your active session, and it always asks before referencing browser history or downloading and uploading files.

One more line from the documentation deserves care. OpenAI says it does not store a separate complete record of your browser actions from the extension. It also says browser activity is stored when it becomes part of the ChatGPT context — text read from a page, screenshots, tool calls, summaries. Read together, that is a statement about the shape of the record, not a promise that nothing is retained: what enters the context can be kept, under your normal ChatGPT data controls.

And one more deserves attention: OpenAI advises treating page content as untrusted. That is the prompt-injection problem stated plainly. A tab you did not write can contain text aimed at the agent reading it. In Chat mode that text can bend an answer. In Work mode, on a signed-in site, it can try to bend an action.

Atlas lost. The extension is where the strategy moved.

This upgrade lands where it does because OpenAI's own browser did not. The company deprecated Atlas in July 2026 and shut it down in August, pointing users to the Chrome extension instead. The extension already had distribution Atlas never built: the Chrome Web Store listing showed about 7 million users as of October 15, and the same connection now works across Chrome, Edge, Brave, Opera and Vivaldi. It is not OpenAI's only remaining browser surface — the desktop app has a built-in browser of its own — but it is the one that lives inside the browser people already use, which makes it the important part of the strategy.

So the contest for the browser is no longer about whose browser you open. It is about whose agent sits inside the browser you already use, and what it is allowed to touch there. Google is building Gemini into Chrome itself. OpenAI is arriving as a guest with a permission dialog. The guest can be removed. It can also be granted every site you visit, which is why the dialog matters more than the demo.

A sensible way to start

Begin with Chat on research tabs you would happily paste into a chat window anyway, and watch how the per-site prompts behave. Keep Work tasks to ones with a stop before the irreversible step — OpenAI's own form example stops before submitting, which is the right instinct. Close or blocklist banking, health and admin tabs before an agent session. And check the Manage screen after the first week: site permissions you granted once and forgot are the actual attack surface here.

What OpenAI has not published: error rates for Work acting in tabs, or a detailed account of its defences against hostile page content in this release. Until those exist, the feature is best judged by the narrowest grant that still does your task.

Sources

  1. [1] OpenAI (primary), "Browser extension", ChatGPT Learn documentation — the per-website permission prompts and the four choices, the Elevated Risk labels on "Allow for all sites" and browser-history access, history access scoped to the request with no always-allow option, the install-time permission list, signed-in sites including LinkedIn, Salesforce, Gmail and internal tools, the instruction to treat page content as untrusted, and what OpenAI stores from browsingRead source
  2. [2] OpenAI Help Center (primary), "ChatGPT Work and Codex" — Work is available on ChatGPT web and mobile for eligible paid plans, subject to plan and workspace settingsRead source
  3. [3] OpenAI Help Center (primary), "Evolving Atlas into ChatGPT for browser-based agentic work" — the Atlas retirement: deprecation announced July 9, 2026, Atlas stopped working August 9, 2026, with browser-based agentic work moving into ChatGPT and the Chrome extensionRead source
  4. [4] Unite.AI (October 15, 2026; summarises OpenAI's official X announcement, the Chrome Web Store listing and OpenAI's browser-extension documentation)Read source
  5. [5] explainx.ai (October 16, 2026; setup, permissions and risk analysis, citing The Verge and Unite.AI)Read source
  6. [6] OpenAI, official ChatGPT account on X (October 15, 2026; announcement posts, as linked and quoted by Unite.AI)Read source