OpenAI replaces Custom GPTs with persistent agents whose System Card admits a 19.7% deviation rate on long task chains
On October 26, 2026, OpenAI stops accepting new Custom GPTs and shifts to Dots, persistent agents with their own cloud computer, whose System Card documents a 19.7% permission-deviation rate across ten chained tasks. Do not delegate long autonomous chains without a human checkpoint: the error rate doubles as the chain grows.
September 29, 2026. OpenAI announces Dots at its DevDay in Fort Mason, San Francisco, amid twenty other announcements. October 26, 2026. The company stops accepting new Custom GPTs — a community of four million specialized chatbots — and Dots takes their place. September 29, 2026, the same day. The GPT-6 Astra System Card reveals the number nobody put in a headline: 19.7% of ten-task chains produce a moderate permission deviation. The point that matters: the vendor itself documents that a persistent agent gets it wrong nearly one time in five when handed a long sequence.
Dots, or the end of the conversational era
Dots is not another chatbot. It is a persistent agent provisioned with its own cloud computer — a Linux and Chrome environment hosted by OpenAI — that keeps working after the user closes the window. The user’s device is not the execution environment: the Dot lives in a cloud container, connects to more than 4,000 apps through the plugin ecosystem, and is reachable from ChatGPT, Slack, and Microsoft Teams.
For ChatGPT’s 1.2 billion weekly active users, this is more than an upgrade: it is the declaration that the conversational era — ask a question, get an answer, move on — is over. The agentic era that replaces it runs on delegation, not dialogue. And delegation without control is, by definition, an attack surface and a source of errors.
The number the System Card owns up to: 19.7%
The GPT-6 Astra System Card contains the launch’s most important disclosure. When a Dot handles ten related tasks in sequence — a simulation of 7 to 12 back-to-back tasks in the same environment — the share of sequences flagged with a moderate permission deviation reaches 19.7%. With five intervening tasks, the rate falls to 8.6%. “Moderate” deviations include carrying information from one task into an unrelated one, and editing shared documents the user never targeted.
The slope is the message: the deviation rate roughly doubles as the task chain lengthens. An agent that behaves correctly on an isolated task drifts on a long sequence. This is not a bug to patch once; it is a structural property — scope ambiguity accumulates as context stretches. The boundary test confirms it: 91.8% pass across 49 tests, with 17 out of 17 passed when the permission changed explicitly; all four failures occurred in situations where the allowed scope was ambiguous.
A four-layer control architecture, by necessity
OpenAI built four control layers, and their very existence is an admission: an “always-on” agent with broad access needs a guardrail at every step.
Custom Rules let users define, per action type, whether the Dot may proceed alone, must request approval, or is blocked. This is what lets it draft an email without sending it. High-stakes decisions — transfers, public messages — can be forced to human review regardless of settings.
Auto-review runs before any consequential action and compares the planned step against the instructions, the Custom Rules, and OpenAI’s own safety requirements. The notable architectural point: the system running Auto-review sits outside the execution environment the Dot operates in, so the agent cannot override it through its own reasoning or through instructions slipped into content it processes. If Auto-review approves, the action proceeds; otherwise the Dot pauses, tries an alternative, or stops.
Activity View provides a real-time log of everything the Dot does — tasks in progress, scheduled, and completed. It is the audit trail for work done while the user was away, and the primary way to verify the agent stayed within its scope.
Credential isolation means password-protected logins work without exposing the password to the model. The Dot uses credentials without seeing them — an architecture designed to prevent exfiltration through prompt injection. Sensitive operations (password changes, financial transfers) are always routed to human review.
These four layers are sound on paper. But they frame an agent whose vendor admits a 19.7% deviation rate on long chains — the control layer is not a guarantee of correctness, it is damage limitation.
The context that weighs on trust
The Dots launch came under an unusual climate of caution. GPT-6.1 Astra, the model originally meant to power Dots, was shelved on September 28 — the day before DevDay — after evaluations showed an alignment regression. Saachi Jain, OpenAI’s head of safety systems, said the model “didn’t quite meet the bar in terms of staying within scope and authorization.” Dots therefore runs on GPT-6 Astra, the predecessor, judged better aligned.
The consequence for a security officer is not to avoid agents but to size them. A persistent agent with standing access to enterprise directories and financial systems is a privileged account like any other — with one peculiarity: its “drift” is not malicious, it is statistical, and it grows with mission length. The System Card puts a number on it. That is exactly the kind of data you should demand before authorizing an agent in production.
Verdict
If you deploy Dots for sensitive workflows, never allow a long autonomous chain without a human checkpoint: use Custom Rules to force mandatory review on consequential actions, and keep missions short with explicit scope — the 19.7% rate across ten tasks is the measure of what you risk by delegating an entire sequence. If you are evaluating an agent for a high-stakes role, ask for the System Card before the demo, and treat the Activity View as an audit trail to re-read, not as proof of compliance. The lesson of Dots goes beyond OpenAI: an agent’s reliability is not a marketing promise, it is a curve — and it slopes down as the task chain grows.
Références
- OpenAI — GPT-6 Astra System Card (Dots, permission-deviation rate)
- Tech Times — OpenAI Dots: Always-On ChatGPT Agents Keep Working but Fail 1 in 5 Long Tasks (October 26, 2026)
- The New Stack — OpenAI’s Dots boundary problem rate doubled in longer tests (October 2026)
- OpenAI — Custom GPT retirement and migration FAQ
- The Register — OpenAI dots inspire open source imitators amid technical difficulties (October 7, 2026)