OpenAI DotOpenAI Dot

模型与开放条件Model & openness

模型不是用户能选的，是厂商指定的 ——

官方发布页原文：「它们由 GPT‑6 Astra 驱动」。

即：Dot 跑在GPT-6 Astra 上，没有模型选择入口。

这与本分区的IDE / CLI 形态形成对照：那两类里模型通常可选， 厂商云形态把「选模型」这件事整个拿掉了。

The model is not user-selectable; it is vendor-assigned —

official launch-page wording: "powered by GPT-6 Astra" (translated).

i.e.: Dot runs on GPT-6 Astra, with no model-selection entry point.

This contrasts with the IDE / CLI forms in this section: there the model is usually selectable, while the vendor-cloud form takes the whole "pick a model" decision away.

运行位置Where it runs

形态的答案就是本产品：

官方原文：「拥有独立的云端电脑」，并有「自己的浏览器」， 且「你随时都能打开 dot 的电脑，检查它的工作」。

官方还写明另一种授权方式：「你也可以授权 Dot 连接并使用你自己的设备， 例如笔记本电脑，让它直接在你的工作环境中与你协作」——

所以 runtime 有两种：默认厂商云VM，可授权访问本机。

The answer to "what form is it" is the product itself:

official wording: "a separate computer in the cloud" (translated), with "its own browser" (translated), and "you can open the Dot's computer at any time to check its work" (translated).

The official pages also state another authorization mode: "you can also authorize Dot to connect to and use your own devices, e.g. a laptop, so it collaborates with you directly in your working environment" (translated) —

so runtime has two modes: the vendor cloud VM by default, with optional authorized access to your own machine.

本地文件Local files

默认完全隔离。官方原文： 「除非你选择连接自己的计算机，否则你的计算机及其中的内容始终与它隔离」。 Dot 的文件都在它自己的云端环境里。

授权连接本机后能做什么，官方安全文档给了具体例子（2026-10-03 补）： 「你也可以选择连接自己的计算机，让 Dot 以更多方式提供帮助， 例如分析保存在桌面上的电子表格，或使用设备上安装的编程工具」。

即本机授权不是「打开文件权限」这一项， 而是桌面文件 + 设备上已装的开发工具两类。

云端工作空间内部还有一层沙盒： 「在每个 Dot 受保护的工作空间内，沙盒机制会限制该 Dot 可以访问的代码和工具， 帮助控制有害代码或错误命令的影响范围」。

多租户隔离也写明了：「将不同用户的云端环境彼此隔离」， 且「Dot 运行代码的环境，与协调其工作及执行关键防护措施的系统相互独立」。

⚠ 只读工具在已连接应用里究竟能读到什么程度，官方仍未给量化边界 （只给了「无法发送消息、更改应用内容」这类否定式描述）。

Fully isolated by default. Official wording (translated): "unless you choose to connect your own computer, your computer and its contents always remain isolated from it". Dot's files all live in its own cloud environment.

What it can do once authorized to connect locally — the official security document gives concrete examples (supplemented 2026-10-03, translated): "you can also choose to connect your own computer so Dot can help in more ways, e.g. analyzing a spreadsheet saved on your desktop, or using programming tools installed on the device".

So local authorization is not one "file access" toggle; it covers desktop files + development tools installed on the device.

Inside the cloud workspace there is another sandbox layer (translated): "within each Dot's protected workspace, sandboxing limits the code and tools that Dot can access, helping contain the blast radius of harmful code or mistaken commands".

Multi-tenant isolation is also stated (translated): "isolating different users' cloud environments from each other", and "the environment where Dot runs code is separate from the systems that coordinate its work and enforce key safeguards".

⚠ How far read-only tools can actually read inside connected apps still has no quantified official boundary (only negative descriptions like "cannot send messages or change app content").

关机后的任务Tasks after shutdown

这一维度的官方材料最完整，官方专门有整节讲： 「即使你没有直接与 Dot 互动，它也会在后台寻找能帮上忙的地方。 我们将其称为『主动研究』」。

官方还写明关闭应用后仍在继续推进工作， 以及「你的 Dot 可以接手项目并自主推进，即使它同时还在处理其他几个项目」。 多任务并行是官方明说的能力，不是推测。

工作空间是持续存在的：「每个 Dot 都有自己的云端计算机，可以在其中浏览网页、 分析信息、创建文件和运行工具。即使你没有主动参与， Dot 也能在这些工作空间中持续推进工作」。

⚠ 「主动研究」期间用的是只读工具 —— 官方原文： 「在此过程中，它会通过仅具备只读权限的工具访问你已连接的应用。 这些工具无法发送消息、更改应用内容，也无法控制你的浏览器或计算机」。

这行限定条件很重要：后台自主 ≠ 后台可改。 ⚠ 后台工作不是无条件跑下去的（2026-10-03 补）： 官方安全文档明确监控可以在执行中暂停它 ——

「如果安全监控在 Dot 正在进行的工作中发现风险，它可以暂停该工作， 并向你显示警告」；发布页版本写的是「可以暂停或停止 Dot 的工作」。 所以「关机后仍在推进」的准确表述是：仍在推进，但可能中途被拦下。

This dimension is its strongest one; the official pages devote a whole section (translated): "even when you are not directly interacting with a Dot, it looks in the background for ways to help. We call this 'proactive research'."

The official pages also state work keeps progressing after you close the app, and "your Dot can pick up a project and drive it forward autonomously, even while it is juggling several others at the same time" (translated). Multi-task parallelism is an officially stated capability, not speculation.

Workspaces are persistent (translated): "each Dot has its own cloud computer where it can browse the web, analyze information, create files and run tools. Even when you are not actively involved, Dots can keep work moving forward in these workspaces".

⚠ During "proactive research" it uses read-only tools — official wording (translated): "in doing so it accesses your connected apps through tools with read-only permissions. These tools cannot send messages, change app content, or control your browser or computer".

This qualifier matters: background autonomy ≠ background write access. ⚠ Background work does not run unconditionally (supplemented 2026-10-03): the official security document states monitoring can pause it mid-execution —

"if safety monitoring detects risk in work a Dot is doing, it can pause that work and show you a warning" (translated); the launch-page version says "can pause or stop a Dot's work" (translated). So the accurate statement of "keeps going after shutdown" is: keeps going, but may be intercepted mid-way.

工具与扩展Tools & extensions

插件生态是核心卖点，官方原文「通过我们的插件生态， 它们可以轻松连接 4,000 多款应用」。

官方明确说应用来源是「你已连接的应用」， 且内置了应用控制选项来管理权限。

另有：可把编码类任务交给 Codex（DevDay 上Codex 本身也宣布云端化）； 正与 Microsoft合作把专职 Dot 接进 Agent 365 的治理与安全控制。

The plugin ecosystem is the core selling point; official wording (translated): "through our plugin ecosystem, they can easily connect to more than 4,000 apps".

The official pages state the app source is "apps you have connected", with built-in app controls to manage permissions.

Also: coding tasks can be handed to Codex (at DevDay, Codex itself was also announced going cloud); working with Microsoft to bring dedicated Dots into Agent 365 governance and security controls.

上下文与记忆Context & memory

跨渠道保留上下文 —— 官方原文： 「dot 会在各个渠道间保留上下文，因此无论你通过哪个渠道联系它， 它都能掌握完整的上下文信息」。

渠道含：

• ChatGPT（桌面/网页/移动）
• Slack
• Teams
• 短信（官方写「即将推出」）
• 语音通话

跨渠道共享的载体官方写明了是「项目」： 「你可以在 ChatGPT 中启动项目，通过 Slack 与负责该项目的团队共享上下文， 再让 dot 继续推进工作」——

即上下文挂在项目上而不是挂在某个渠道上，这是它能跨渠道的机制前提。

官方强调学习机制：「能在长期使用中从反馈里学习」「合作越多， Dot 就越了解你的偏好、思考方式，以及你心目中好工作的标准」。

⚠ 训练数据默认不用于改进模型，但有一条重要例外（2026-10-03 补， 旧版档案漏了这条）：官方原文「默认情况下，我们不会使用 ChatGPT Business、Enterprise 或 Edu 工作空间中的内容来改进模型」。

限定在三个工作空间档位——按发布页字面， 个人档与 Pro 档的去向官方在此页没有同样的表述， 这三档之间是否存在差异，官方页面未说明。不要把「不用来训练」推广到所有档位。

上下文窗口大小与记忆存储实现，官方两个页面均未给数字。

Context persists across channels — official wording (translated): "dots keep context across channels, so whichever channel you reach them through, they have the full picture".

Channels include:

• ChatGPT (desktop/web/mobile)
• Slack
• Teams
• SMS (officially "coming soon")
• Voice calls

The carrier of cross-channel sharing is stated officially as "projects" (translated): "you can start a project in ChatGPT, share context with the team on that project via Slack, and let the dot keep the work moving" —

i.e. context hangs on the project rather than on a channel, which is the mechanistic precondition for going cross-channel.

The official pages stress the learning mechanism: "learns from feedback over long use"; "the more you work together, the more Dot understands your preferences, how you think, and what you consider good work" (translated).

⚠ Training data is not used to improve models by default, but there is one important exception (supplemented 2026-10-03, previously missed in this dossier): official wording (translated) "by default, we do not use content from ChatGPT Business, Enterprise or Edu workspaces to improve our models".

The statement is scoped to three workspace tiers — per the launch page wording, for personal and Pro tiers this page gives no equivalent statement, and whether the tiers differ is not explained on the official pages. Do not generalize "not used for training" to all tiers.

Context-window size and memory storage implementation — neither official page gives numbers.

权限与限制Permissions & limits

本档案权限信息最完整的一份，官方有独立两节。

分三层：

① 自定义规则 —— 官方原文：「通过自定义规则，你可以允许特定操作、 要求先获批准，或禁止这些操作」，且「内置安全要求始终有效」 （即自定义规则只能在官方底线之上收紧，不能放松）；

② 自动审核 —— 「对于可能影响你的账户或分享信息的操作，Dot 会通过自动审核」， 官方说明审核判据是「是否符合你的指令、自定义规则和安全要求」， 且明确「更改密码等特定敏感任务始终需要由你亲自完成」；

③ 凭据隔离 —— 「登录受支持的网站时，Dot 可以使用已保存的密码， 而无需向模型透露这些密码」。

④ 运行期监控会真的拦下来（2026-10-03 补，旧版档案缺这一层）： 官方安全文档写「我们还会在 Dot 规划和执行操作时进行监控， 查找潜在有害行为，例如超出你的指令范围，或试图绕过防护措施。

如果安全监控在 Dot 正在进行的工作中发现风险，它可以暂停该工作， 并向你显示警告，供你查看」。

这是「审核」与「执行」分离的实证 —— 不是只在动作前拦， 也能在执行中停下。

这是它与 Meta Muse「审批交给另一个 agent」最接近的一层， 但官方未说明这个监控器是否独立于模型（Muse 明写了 Sentinel 系统级隔离， Dot 没写）—— 这一项不要替它补。

审计面：官方提供活动视图（activity view）可跟进进度含后台工作。

⚠ 官方同一页也写了「Dot 仍可能出错，因此，请务必检查可能产生重要影响的工作成果」。

This dossier has the most complete permission information of the three; the official pages have two dedicated sections.

Three layers:

① Custom rules — official wording (translated): "with custom rules you can allow specific actions, require approval first, or block them", and "built-in safety requirements always apply" (i.e. custom rules can only tighten above the official floor, never loosen it);

② Automated review — "for actions that could affect your account or share information, Dot runs automated review" (translated), the official criteria being "whether it matches your instructions, custom rules and safety requirements", and it explicitly states "certain sensitive tasks like changing passwords always require you personally" (translated);

③ Credential isolation — "when logging into supported sites, Dot can use saved passwords without revealing them to the model" (translated).

④ Runtime monitoring really does intervene (supplemented 2026-10-03; this layer was previously missing): the official security document states (translated) "we also monitor Dot as it plans and executes actions, looking for potentially harmful behavior, e.g. going beyond your instructions or attempting to bypass safeguards.

If safety monitoring detects risk in work a Dot is doing, it can pause that work and show you a warning for you to review".

This is evidence of "review" and "execution" being separated — it does not only gate before actions; it can also stop mid-execution.

This is the layer closest to Meta Muse's "approval handed to another agent", but the official pages never state whether this monitor is independent of the model (Muse explicitly states Sentinel system-level isolation; Dot does not) — do not fill this in for them.

Audit surface: the official pages provide an activity view to follow progress including background work.

⚠ The same official page also states "Dots can still make mistakes, so be sure to check work products that could have significant consequences" (translated).

适合什么任务Best for

官方给的是岗位化场景，值得直接抄成选型依据：

• 把反馈转成经过测试的修复（交完整 PR 附演示视频）
• 产品范围变化时调整发布方案
• 拿到新证据后重跑分析并更新论文图表
• 销售提案随需求变化更新
• 内容制作自动完成

反过来说它不适合：要自己挑模型的人；数据不能出本机的人； 需要随时接管的精细控制流（本机 IDE/CLI 形态更合适）。

What the official pages give are role-based scenarios, worth copying directly as a selection basis (translated):

• turning feedback into tested fixes (delivering a full PR with a demo video)
• adjusting release plans when product scope changes
• re-running analyses and updating paper figures when new evidence arrives
• keeping sales proposals updated as requirements change
• content production running automatically

Conversely it does not fit: people who want to pick their own model; people whose data cannot leave the machine; people needing fine-grained control with takeover at any moment (local IDE/CLI forms fit better).

即使你没有直接与 Dot 互动，它也会在后台寻找能帮上忙的地方。
我们将其称之"主动研究"。在此过程中，它会通过仅具备只读权限的工具
访问你已连接的应用。这意味着这些工具无法发送消息、更改应用内容，
也无法控制你的浏览器或计算机。

Even when you are not directly interacting with a Dot, it looks in the background
for ways to help. We call this "proactive research". In doing so, it accesses your
connected apps through tools with read-only permissions. That means these tools
cannot send messages, change app content, or control your browser or computer.
(translated)

更改密码等特定敏感任务始终需要由你亲自完成。

Certain sensitive tasks like changing passwords always require you personally. (translated)

登录受支持的网站时，Dot 可以使用已保存的密码，
而无需向模型透露这些密码。

When logging into supported sites, Dot can use saved passwords
without revealing them to the model. (translated)

Pro 或 Business Premium 套餐已包含你的首个 Dot，无需额外付费。

Your first Dot is included with Pro or Business Premium plans, at no extra cost. (translated)

本页由This page is generated from the ai-handbook 数据层生成（CC BY 4.0）。data layer (CC BY 4.0). 方法论与坐标系定义见仓库内For the methodology and coordinate definitions, see METHODOLOGY.md.