Analysis · curated 2 Sep 2026
Understanding ChatGPT Work
First reported simonwillison.net
Coverage timeline
Single-source analysis — first reported, latest, and curated coincide.
Why it matters
ChatGPT Work's combination of private-data access, untrusted-content ingestion, and outbound communication channels is exactly the configuration that makes agentic systems vulnerable to prompt-injection-driven data exfiltration, a risk defenders must weigh before deploying the paid tier.
Simon Willison's teardown of OpenAI's ChatGPT Work (specifically the cloud variant, Work Cloud) argues its feature set — internet-enabled code execution, a headless Chrome browser, a persistent scratch filesystem, sub-agents, scheduled automations, and Cloudflare Workers site deploys — combines all three elements of his 'lethal trifecta': access to private data, exposure to untrusted content, and a channel to exfiltrate stolen data. Willison does not demonstrate an exploit but asks OpenAI to explain how it defends Work sessions against prompt injection, criticizing the product's opacity around system prompts and tool descriptions.