Understanding ChatGPT Work
Simon Willison’s Weblog Simon Willison
OpenAI’s ChatGPT Work is out, and it’s really two products. The cloud version can run code, browse the web, and even build sites; the confusing part is the point.
Based on reporting by Simon Willison’s Weblog, Simon Willison — read the original for the full story.
Summary, retelling and take written by AI under human oversight; images are AI-generated illustrations. How we work · Report an error
OpenAI announced ChatGPT Work on July 9 and has been pushing updates hard ever since. Simon Willison’s verdict after digging through it: this is a powerful product that is also weirdly hard to explain. The first twist is that “Work” actually means two different things, and only one of them is the interesting one.
The cloud version runs through chatgpt.com and the mobile apps. That’s the one Willison calls Work Cloud, and it’s the one he focuses on. The desktop app — formerly Codex — unlocks a separate Work Local mode that can touch files and run programs on the user’s own machine. It sounds more like Codex with a friendlier coat of paint, and not much else.
Access is still limited to paid subscribers at $20 a month and up. Free users and the $8 Go tier are locked out. OpenAI presents Work as something you use when you want a task finished, not just a reply generated, but Willison says that distinction is close to useless because people have already been using ordinary ChatGPT for briefs, analysis, drafts, and other chores for years.
The real difference, he says, is in the tools. Work can use Luna and Terra instead of Sol, run code with internet access, launch a full headless Chrome browser, keep a persistent filesystem across sessions, publish ChatGPT Sites, spin up sub-agent sessions, and schedule prompt automations. The code environment is the star here. Unlike ChatGPT Chat, it can reach out to the wider web, install dependencies, clone GitHub repositories, and then use that setup to talk to live sites and APIs.
The browser piece is just as strong. Work can load pages, fill forms, take screenshots, and even run JavaScript against the DOM. If a site needs a login, it can hand control back to the user for passwords and 2FA without feeding those secrets through the model. And because the filesystem persists, Work sessions can pick up old scratch folders and keep moving, which makes it feel less like a toy chat window and more like a messy shared workspace.
What worries Willison most is safety. Work combines private data, untrusted content, and a way to send information back out again — the exact mix that makes agent systems risky under his “lethal trifecta” model. His bigger complaint, though, is simpler: OpenAI has made a product that does a lot, but explains very little about how it actually works.
My take — AI-written commentary, not fact-checked reporting
OpenAI keeps selling “what it’s for” when people need “what it does,” which is classic product fog dressed up as strategy. The feature set sounds like a power user’s dream and a security team’s migraine, and both can be true at once. Hiding the system prompt and tool details doesn’t make the product feel premium; it just makes it feel like a drawer full of sharp objects.
Read more about this at: Simon Willison’s Weblog