Analysis
Understanding ChatGPT Work
Publication date not yet evaluated · Added simonwillison.net
Page published
Coverage timeline
Single-source analysis — one report is available.
Why it matters
ChatGPT Work's combination of private-data access, untrusted-content ingestion, and outbound communication channels is exactly the configuration that makes agentic systems vulnerable to prompt-injection-driven data exfiltration, a risk defenders must weigh before deploying the paid tier.
Simon Willison's teardown of OpenAI's ChatGPT Work (specifically the cloud variant, Work Cloud) argues its feature set — internet-enabled code execution, a headless Chrome browser, a persistent scratch filesystem, sub-agents, scheduled automations, and Cloudflare Workers site deploys — combines all three elements of his 'lethal trifecta': access to private data, exposure to untrusted content, and a channel to exfiltrate stolen data. Willison does not demonstrate an exploit but asks OpenAI to explain how it defends Work sessions against prompt injection, criticizing the product's opacity around system prompts and tool descriptions.