Operator System Card

OpenAI dropped a system card for Operator, the agent it built to actually use a computer on your behalf: clicking buttons, filling forms, navigating websites like a person would. That kind of autonomy is exactly why the safety document exists. An AI that can only chat is limited in how much damage it can do. One that can browse the web, log into accounts, or make purchases is a different animal entirely, and OpenAI is trying to get ahead of that before Operator ends up in more hands.

The bulk of the card focuses on prompt injection and jailbreaks, which is the obvious attack surface for any agent that reads and acts on content from the open web. A malicious webpage could, in theory, plant instructions designed to hijack the agent mid-task. OpenAI says it layered defenses at both the model level and the product level to catch and block that kind of manipulation, rather than relying on a single line of defense.

Privacy and security get their own section too, which makes sense given Operator's whole job is interacting with real accounts and real data. Letting an agent operate your browser session raises stakes that a normal chatbot never has to deal with: leaked credentials, unintended purchases, data it wasn't supposed to touch.

OpenAI also describes external red teaming and a round of safety evaluations meant to stress-test Operator before wider release, plus an acknowledgment that this is ongoing work rather than a finished product. That framing is honest, if a little predictable at this point: every major AI lab now ships the caveat that safeguards are a moving target, not a solved problem.