2026-08-31 / Signal #7
ChatGPT Work hits the “lethal trifecta
“The work AI can see your files, browse the web, and ship a site. That’s the combination security people have been screaming about.”
The Story
OpenAI’s ChatGPT Work is not just ChatGPT with a business login. It can run code that hits the internet, drive a headless browser, keep a scratch filesystem, spawn sub-agents, schedule automations, and deploy sites. Willison’s long-standing warning: any agent with private data, untrusted web content, and a way to send data out is a prompt-injection time bomb. He asks OpenAI how Work is actually defended — the product page describes *purpose*, not *mechanism*.
Why It Matters
Builder-facing future-shock. The office AI now has a computer, a browser, and a deploy button. Distinct from the already-covered “persistent Codex until sleep” story.
Evidence
Simon Willison, 30 Aug 2026; HN. Work Cloud adds internet-connected code, headless Chrome, persistent scratch disk, sub-agents, scheduled jobs, and Cloudflare deploys. Willison says that is private data + untrusted content + exfil channel.
Sources
Daily scan: 2026-08-31