Simon Willison spent weeks reverse-engineering ChatGPT Work, the agentic product OpenAI launched in July. His conclusion: it is really two products — Work Cloud (in the browser and mobile apps) and Work Local (the renamed Codex desktop app) — and the cloud version is the one worth understanding. It is also $20/month and up only.

What separates Work from plain ChatGPT Chat:

  • Code execution with full internet access — it can clone GitHub repositories, install dependencies, and talk to any API. Chat’s sandbox blocks that; even Claude’s container allows only a short list of sites
  • A full headless Chrome browser — it loads pages, fills out forms, and takes screenshots. When a site needs a login, it can hand over to you for passwords and two-factor codes without those secrets ever passing through the model
  • A persistent filesystem shared across sessions — files from one chat stay available in the next. Willison already has 171 scratch folders
  • ChatGPT Sites — it can build and deploy real websites on Cloudflare Workers, databases included, from a single prompt
  • Sub-agents — parallel model sessions working on one project — plus scheduled prompts that check things for you on a timer

The demo that sells it: one prompt asked Work to find every “pelican in her piety” in London, turn the results into a JSON file, and build a website about them. It did all of it, end to end, from one instruction.

Willison’s biggest open question is safety. His “lethal trifecta” rule — private data, exposure to untrusted content, and a channel to send stolen information out — is fully met by Work’s design, and OpenAI has said little about how it defends sessions against prompt injection (malicious instructions hidden in content the agent reads).

His frustration is pointed: figuring this out took far more work than it should have, because OpenAI documents what Work is for rather than what it does. He had to make a Work session build a public reference site listing all 223 of its own tools to learn what the product can actually do. If OpenAI published its system prompts and tool descriptions, he notes, he wouldn’t have needed to write the post at all.