Operator is available to all users in the US on the Pro plan.
General Overview
⚠️ Operator is a research preview and may make mistakes. Users are responsible for monitoring its output and using it responsibly.
What is Operator?
Operator is a research preview of an agent that can go to the web to perform tasks for you. It can automate various tasks—like filling out forms, booking travel, or even creating memes—by remotely interacting with a web browser much as a person would, via mouse clicks, scrolling, and typing.
Who can use Operator?
Operator is available at operator.chatgpt.com. Currently, Operator can only be accessed by ChatGPT Pro users in the United States who are at least 18 years of age. We’re starting small to gather user feedback and refine Operator’s capabilities. Over time, we’ll make it available to other paid users and integrate it directly into ChatGPT.
How does Operator work?
Operator uses a model called Computer-Using Agent (CUA), built on GPT-4o to interpret screenshots and interact with sites using typical browser controls like a cursor and mouse. You describe the task (e.g., “Book a flight,” “Order groceries”), and Operator executes the necessary steps. If it encounters a challenge—like a CAPTCHA or password field—it will pause and prompt you to take over, ensuring you stay in control.
What happens if Operator encounters a task it cannot complete?
If Operator gets stuck—whether due to a complex interface or missing details—it will notify you and pause, suggesting you take over. Once you manually resolve the issue (or give it the information it needs), you can either finish the task yourself or hand control back to Operator. This ensures a seamless collaboration where you remain in charge.
What tasks is Operator unable to perform?
Currently, Operator cannot reliably handle many complex or specialized tasks, such as creating detailed slideshows, managing intricate calendar systems, or interacting with highly customized or non-standard web interfaces.
In this research preview stage, Operator will proactively refuse certain higher-stakes tasks (e.g., conducting financial transactions, sending emails, deleting a calendar event). As Operator evolves, its capabilities will expand, but for now, these limitations help ensure accuracy, reliability, and safety in its operation.
Can Operator handle multiple tasks at once?
Yes. Operator does allow you to run multiple tasks in parallel. However, for security reasons, Operator places dynamic limits on the number of simultaneous tasks and open conversations you can have at any given time, and these limits may change. If you ever reach a limit, you’ll receive a notification. If you have further questions, feel free to reach out to our support team at help.openai.com.
Here is what you can expect to see when reaching the limits of maximum conversations:
Here is when you will see when you reach the daily limit:
Can I save reusable tasks I perform often in Operator?
Yes. You can create a saved task for workflows you want to repeat regularly (e.g., summarize the news, book a restaurant). You can save tasks either directly from the conversation by clicking “Save Task” or from the Settings menu. These saved tasks appear on your homepage, making it easy to start them with a single click.
How do I share an Operator task?
To share a video of Operator performing a task, click the ‘Share’ button in the conversation view and select ‘Publish’ to generate a shareable URL. Anyone with the link will be able to view a summary of your original prompt along with the video of Operator completing the task. If you’ve already published a video and Operator has performed additional actions you’d like to include, click ‘Share’ and then ‘Sync Video’ to update it.
Before sharing, make sure to review the video for any sensitive information. If you no longer want the video to be publicly accessible, open the conversation, click ‘Share,’ and select ‘Unpublish.’ Once unpublished, the link will no longer grant access to the video.
Is there a limit to how much I can use Operator?
Operator use is subject to reasonable rate limits (such as limits on the number of concurrent tasks and minutes of usage) in order to ensure the product works well for everyone.
Safety and Privacy
What safety measures are in place to prevent misuse?
Operator incorporates multiple safeguards, including user confirmations for high-impact actions, refusal patterns for disallowed tasks, prompt injection monitoring, and a “watch mode” requiring user supervision on certain sites. These measures are designed to help prevent harmful or unintended outcomes. However, these measures don’t eliminate all risks. It remains important to monitor Operator and exercise care when using it.
Example: Violations of our Usage Policies or Terms of Service may lead to a warning or in instances of repeated abuse, loss of your Pro subscription or a ban on your account. We encourage you to review your service usage and implement measures to prevent such abuse.
How can I log in to websites or enter sensitive information (e.g., passwords) using Operator?
When Operator encounters a step that requires logging into a website or entering a password, it should pause and prompt you to take over, also referred to as “take over mode”. In take over mode, Operator does not take screenshots of the browser. This enhances privacy for passwords and other data entered by the user.
Once you have finished the step Operator has prompted you to complete, you can return control to Operator. It will then seamlessly resume its automated workflow from where it left off.
Why does Operator take screenshots?
Operator takes screenshots to “see” the browser interface it interacts with, much like a person would view a screen. This allows it to navigate graphical user interfaces (GUIs), such as buttons, menus, and text fields, enabling it to perform tasks. Screenshots also help Operator reason about what actions to take and adjust its behavior if it encounters challenges or errors during a task.
What do the screenshots capture?
Screenshots capture the window in the remote browser environment where Operator is active.
How is Operator user data, including screenshots, used?
User data in Operator, including screenshots, are used in accordance with OpenAI’s Privacy Policy – for example, to provide you with the Operator services, to help ensure safety (e.g., detecting fraudulent activity), and to improve our models as we describe more fully below. You have control over how long we retain your data in Operator, and whether we use it to improve our models, which we also describe further below.
How long are Operator chats and screenshots retained?
Your chats in Operator, browsing history in Operator, and screenshots associated with those conversations, are retained until you delete them. Through the Operator settings page, users can delete past browsing data or chats. Deleting a chat deletes the screenshots taken during that chat. Deleted chats and associated screenshots will be deleted from our systems within 90 days.
What are the Privacy and Security settings in Operator?
Operator’s Privacy and Security settings include a setting to delete past chats (including screenshots) and browsing data, as well as a link to your ChatGPT settings, where you control whether your data is used to improve OpenAI’s models.
In Operator, you’ll see a single “Improve the model for everyone” setting. This links to ChatGPT’s website for management.
Operator does not maintain its own separate version of this setting—toggling it off in ChatGPT applies to both ChatGPT and Operator.
From Operator’s Privacy and Security setting, click on “Manage on ChatGPT” to open ChatGPT’s website and access the “Improve the model for everyone” toggle.
If ChatGPT’s control is already OFF when you first use Operator, it also applies to Operator.
If the setting is toggled ON, we may use your data in Operator to improve the model. This includes screenshots, conversations, browsing, custom instructions, “Catch Operator up” context, and other data in Operator.
How to turn off model training:
Open Operator Settings then navigate to Privacy and Security and click Manage on ChatGPT next to “Improve the model for everyone.” which will open ChatGPT:
On ChatGPT’s site, look for the Data Controls (or “Privacy” settings). To turn off model training, navigate to the profile icon > Settings > Data Controls, and click on disable Improve the model for everyone:
In the Model improvement modal that appears be sure the toggle Improve the model for everyone is OFF:
Turn OFF Improve the model for everyone.
When this setting is OFF, your new conversations won’t be used for training OpenAI models. (You may separately choose to delete prior chats and screenshots as described above.)
Do humans review my Operator content?
Just as with ChatGPT, your Operator content (including screenshots) may be accessed by a limited number of authorized OpenAI personnel, as well as trusted service providers that are subject to confidentiality and security obligations in order to: (1) investigate abuse or a security incident; (2) provide support to you if you reach out to us with questions about your account; (3) handle legal matters; or (4) improve model performance (unless you have opted out). Access to content is subject to technical access controls and limited only to authorized personnel on a need-to-know basis. Additionally, we monitor and log all access to user content and authorized personnel must undergo security and privacy training prior to accessing any user content.
How does Operator protect against security threats?
Operator employs tools that seek to limit the model’s susceptibility to malicious prompts, hidden instructions, and phishing attempts. A monitoring system pauses execution if suspicious activity is detected, while automated and human-reviewed pipelines continuously update safeguards.