ChatGPT Agent: Delegating Multi-Step Tasks Safely

When OpenAI launched ChatGPT agent, its own CEO opened with a warning.

"It's a new way to use AI, but there will be a new set of attacks that come with that," Sam Altman said, according to Decrypt's launch coverage.¹ I appreciate the honesty. It is also the right frame for anyone who runs a small business and is tempted to hand a new tool the keys on day one. Capability and permission are two separate decisions.

What is ChatGPT agent, in plain terms?

It is a mode that takes a goal and works toward it across several steps, without you clicking through each one. Per Decrypt, it runs on a cloud-based virtual computer, uses a text browser and a terminal, and can work with third-party apps such as Google Drive and GitHub. OpenAI's examples included trip planning, hotel booking, competitor research, slide decks and online orders.¹

The agent was announced on July 17 and rolled out to Plus, Pro and Team subscribers on July 24.² If you have been reading about AI "agents" for a year, this is the version that finally ships inside a product millions of people already use.

What can go wrong when an agent acts for you?

Three things, in rough order of how likely they are.

It does the wrong thing confidently

Agents make mistakes the way a fast new hire does: with total confidence and no sense of the stakes. Anthropic's Project Vend (I broke it down in Project Vend) showed this in a small shop, where an AI shopkeeper gave items away, sold some below cost and briefly invented a payment account.⁴ Nobody is immune to this. It is a feature of the technology.

It reads something hostile

Prompt injection is the headline risk, and it is why I was cautious about Operator and Computer Use too. Hidden instructions in a web page, an email or a document can try to steer an agent into leaking data or taking actions you did not request. Decrypt reported that OpenAI's team acknowledged the new threat, with Casey Chu saying "We've trained the model to ignore suspicious instructions on risky websites," and also saying "users need to stay cautious."¹

It has access it should not have

This one is entirely in your hands. OpenAI warned that signing the agent into websites or enabling connectors gives it access to sensitive data from those sources, such as emails, files or account information, and that it can take actions like sharing files or changing account settings.² Decrypt also noted that multi-factor authentication may not protect an account if the agent can reach the email or SMS codes.²

How do you set permissions before the first task?

Think like you would for a new contractor on day one: they get a desk, not the vault.

Where the checkpoints go

The agent is designed to ask for explicit approval before important actions, such as purchases or accessing sensitive data, and it stops short of entering card information until you approve, per Decrypt.¹ I treat that as a minimum, not a safety net. Add your own: ask it to show its plan before it starts, and to stop before anything leaves your account.

Anthropic's guidance on building agents makes the same point from the other side: agents can pause for human feedback at checkpoints or when they hit blockers, and extensive sandboxed testing and guardrails matter because autonomy raises cost and the risk of compounding errors.³

OpenAI's own team made the case in public six months earlier, at the January 23, 2025 launch of its first agent, Operator. One researcher described safety as layers rather than one switch: "it's this stack of mitigations that each incrementally reduce the risk to the point where we feel comfortable deploying."⁶ That is a company describing its own safeguards. It is a reason to read them and a reason to set your own limits anyway.

Plays here, from YouTube

Which tasks are worth testing first?

Pick tasks that produce something you can verify in minutes, and that cost nothing if they are wrong.

How to judge whether it helped

Do the job yourself once and time it. Then run the agent, review the output and time that too, including the checking. A related caution comes from METR, whose July 2025 randomized trial found that experienced developers took 19% longer with AI tools while believing they had been faster. That study covered one kind of work and does not say AI is slow in general, but it is a reminder that feeling fast and being fast are different things.⁵

What should you not delegate yet?

Anything where a confident mistake is expensive or hard to reverse: payments, legal commitments, public statements and decisions about people. These are the same lines I would draw for any new hire in their first month.

Working without staff, I think a lot about which work genuinely needs a human and which does not. My rule for any new agent is simple: it earns more authority by logging a record of boring, checked success, not by looking impressive in a demo. I apply the same ladder when I design AI-assisted systems for clients.

A seven day trial plan

Agents like this will keep improving, and the temptation will be to expand access faster than your confidence. Resist it. Slow trust is cheap. Fast trust is how a quiet Tuesday becomes a long email to your customers.

Keep building.Ekai