# ChatGPT agent tutorial: write a browser task it can finish

> ChatGPT agent is OpenAI's agent that works in a remote browser for you. It opens pages, clicks and types, and it pauses to ask before certain actions, such as completing a purchase or sending an email. You describe a task, answer those prompts and check the result. This lesson covers writing the task, staying with it and what it will not do.

Mindket editors · Published 2026-11-06 · Updated 2026-11-06 · https://mindket.com/learn/ai-browser-agents/chatgpt-agent-tutorial

## In short

- Give each task a start page, a result to hand back and a line that stops it before it submits, buys or sends.
- Redirect it in the chat during the first minute, before a wrong turn runs to the end.
- Answer yes to a confirmation only after you have read the state it shows you.
- Open the pages it names and compare, because its summary is not proof.

## What ChatGPT agent is

OpenAI's system card of 17 July 2025 calls ChatGPT agent a new agentic model in the same family as OpenAI o3. It combines the research of deep research with Operator's way of working through a remote visual browser, and it adds two more tools. Wikipedia dates the release to July 2025 and says it controls a virtual computer, and that you can interrupt a task or give it more instructions as it goes.

OpenAI's help pages and its newer app pages could not be read when this lesson was written, so the lesson names no menu and no plan. It teaches what holds across versions: what the agent does, what it asks and how to write the task. Where the card describes launch behaviour, the lesson says so, because later versions may differ.

- A remote visual browser, where the agent looks at the page, then clicks and types.
- A terminal with limited network access, for running code, analysing data and making slides or spreadsheets.
- Connectors to external data sources and applications, such as Google Drive.

## Write a task it can finish

A task you can finish in one read-through has three parts: where to start, what to hand back, and where to stop. The first keeps the agent on a page you know. The second gives you something to check. The third turns the agent's confirmation habit into a rule you wrote yourself.

The example below uses a public page and a read-only job, so nothing can be spent or sent, and you can check both dates on the same page.

> **A task template**
>
> Start at [page]. Find [the thing]. Give me [what to hand back], with the address of each page you used. Do not sign in, submit, buy or send anything. If a step needs one of those, stop and ask me.

````text
Start at https://en.wikipedia.org/wiki/ChatGPT_Atlas. Find the date Atlas was released for macOS and the date it shut down. Give me both dates and the address of each page you used. Do not sign in, submit or send anything.
````

> The template and the example task are this lesson's own wording, not OpenAI's. The two dates the example asks for are on Wikipedia's ChatGPT Atlas article, so you can check the agent's answer there.

## Run it and stay with it

1. Start a new agent task in ChatGPT. This lesson names no menu, so use OpenAI's own help page for where that option sits in your version.
2. Paste your task. Keep it to one job.
3. Watch the first pages it opens. They should match the start page you named. If they do not, step in and say so. Wikipedia notes that you can give new instructions while a task runs.
4. When it asks for confirmation, read the state it shows before you answer. OpenAI says you can review the state or the actions and then correct mistakes or redirect it.
5. If the task touches a signed-in email or bank account, stay on the conversation. At launch, Watch Mode paused the agent when you became inactive or left it.
6. When it says it is done, open each page it names and compare the result with the page.

## What stops it, and what limits it

Each row is a behaviour OpenAI describes in the system card for the launch version, with what it means for you. None of them replaces your own check. The card says OpenAI built automated monitors and filters against prompt injection. It can update them when it learns of new attacks. The mitigations the card lists are some, but not all, of those in the product.

| Behaviour | What the card says | What it means for you |
| --- | --- | --- |
| Confirmations | The agent pauses and asks before certain kinds of actions online, such as completing a purchase or sending an email. | Read the state it shows, then say yes, no or redirect. |
| Watch Mode | In a sensitive context such as a signed-in email or banking account, it pauses when you become inactive or leave the conversation. | Stay on the conversation for those tasks. |
| Terminal limits | Terminal network requests were limited to GET requests that download images or certain datasets. | It could fetch files from the terminal but not post to sites. |
| Memory | ChatGPT memory was disabled at launch, to reduce the risk of prompt injections taking data from it. | Do not expect it to know you from earlier chats. |
| Blocked sites | At the system level, it cannot navigate to certain sites tied to harmful or illicit activity. | A task that needs one of them cannot finish. |

## How often it asked before it acted

OpenAI measured whether the model asked before an action that called for a confirmation. Its card reports 91.0% over all such actions, 100.0% before editing permissions or completing a financial transaction, and 99.9% before sending a high-stakes message. OpenAI says the 91.0% figure is an underestimate, because a large share of the failures in that test were false negatives.

Those numbers describe one model on OpenAI's own test, so read them as asks nearly every time, not every time. Stay at the screen for anything that spends money or sends a message.

**How often ChatGPT agent asked before an action** OpenAI's test for the July 2025 model, in percent. Higher means it asked more often.

- All actions that needed a confirmation: 91.0%
- Editing permissions: 100.0%
- Sending high-stakes messages: 99.9%
- Completing financial transactions: 100.0%

Source: [OpenAI: ChatGPT agent system card](https://deploymentsafety.openai.com/chatgpt-agent) (read 2026-11-06)

## What it will not do

These are the rules and refusal rates that OpenAI's ChatGPT agent system card gives for the July 2025 model. Later versions may differ.

- OpenAI says it should not do online research to fetch or infer personal data that people expect to keep private, and in its test it correctly refused privacy-invasive tasks 98.5% of the time.
- It should not transact for regulated goods or gamble. In its test for disallowed financial tasks such as gambling, it correctly refused 97.0% of the time.
- It should not help with high-stakes financial steps such as account transfers, and in that test it correctly refused 89.0% of the time.
- People who use the agent are bound by OpenAI's usage policies and may not bypass its safety measures.

## Watch OpenAI's introduction

OpenAI put its introduction to ChatGPT agent on its YouTube channel.

[Introducing ChatGPT agent](https://www.youtube.com/watch?v=Wgn4JeYI9lY)

OpenAI's video introducing ChatGPT agent, on OpenAI's YouTube channel.

## Common mistakes

- Writing a goal with no finish line, such as find me something good. A task that names the page and the result is one you can check.
- Starting with a job that spends money. A read-only job on a public page costs nothing if it goes wrong.
- Answering yes to a confirmation without opening the state it shows.
- Leaving a task that touches a signed-in account. Watch Mode exists because OpenAI expects you to supervise those.
- Treating the confirmation rate as a promise that it asks every time.
- Following a tutorial that points to an Atlas menu without checking its date. Wikipedia lists Atlas as shut down on 9 August 2026.

## Try it yourself

- Run the example task as written, then open the Wikipedia article and check both dates.
- Ask for a fact the page does not hold, and note whether the agent says it could not find it or invents an answer.
- Start any read-only task, interrupt it after the first page with a new instruction, and note whether it follows.
- Write a template of your own with a stop line and keep it for your next task.

## Next: the computer use API

[Computer use API](https://mindket.com/learn/ai-browser-agents/computer-use-api) is lesson 3, written for developers. It shows the screenshot, action and result loop behind tools like these, with code from Anthropic's and OpenAI's own repositories.

## Check yourself

1. Which task can ChatGPT agent finish and you check in one pass?

   A. Find me a good laptop deal
   B. Keep an eye on my inbox and deal with what matters
   C. Start at one named page, find two dates and give me the address of each page you used

   Answer: C. A named start page and a result you can compare make the task small enough to check, and the other two have no finish line.

2. The agent asks you to confirm an action. What do you do first?

   A. Read the state it shows and decide whether it should proceed
   B. Say yes, since it only asks about safe steps
   C. Close the chat so it stops

   Answer: A. OpenAI says you can review the state, then indicate whether it should proceed, correct mistakes or redirect it.

3. What did OpenAI's system card say Watch Mode does?

   A. Records the agent's screen for OpenAI to review
   B. Blocks every site that needs a sign-in
   C. Lets the agent keep working while you are away from the screen
   D. Pauses it when you become inactive or leave the conversation, in a sensitive context such as a signed-in email or bank account

   Answer: D. The card says Watch Mode is meant to make you supervise the agent in a sensitive context.

4. OpenAI's test found ChatGPT agent asked before 91.0% of the actions that needed a confirmation. How do you read that?

   A. It asked every time, so you can leave
   B. It asked nearly always, and OpenAI calls the figure an underestimate, so you still stay at the screen for money and messages
   C. It asked only 9% of the time, so it cannot be trusted at all

   Answer: B. The figure is one model on one test, and a large share of its misses were false negatives, so it means nearly always, not always.

## Frequently asked questions

### How do I use ChatGPT agent?

Give it one task, reply when it asks you to confirm, then check the result against the pages it names. This lesson names no menu, because OpenAI's help pages could not be read and menus change, so follow OpenAI's own page for the current steps.

### What is ChatGPT agent?

ChatGPT agent is the name OpenAI gave in July 2025 to a model that browses, runs code in a terminal and uses connectors to finish tasks. Its system card lists a remote visual browser, a network-limited terminal and connectors such as Google Drive.

### Will ChatGPT agent buy things or send email without asking me?

OpenAI trained it to ask before finalising actions that affect the state of the world, such as a purchase or an outgoing email. Its July 2025 test found it did not always ask, so stay at the screen for money and messages.

### Is ChatGPT agent the same as Operator?

No. Operator was OpenAI's January 2025 agent that worked through a browser in a virtual machine. ChatGPT agent, in the system card's words, combines Operator's remote visual browser with the research of deep research, and adds a terminal and connectors.

### Is ChatGPT agent the same as agent mode in Atlas?

No. Atlas was OpenAI's own Chromium browser, and agent mode was an optional feature in it for paid plans. According to Wikipedia, Atlas closed on 9 August 2026.

## Sources

- [OpenAI: ChatGPT agent system card](https://deploymentsafety.openai.com/chatgpt-agent) (read 2026-11-06)
- [Wikipedia: ChatGPT](https://en.wikipedia.org/wiki/ChatGPT) (read 2026-11-06)
- [Wikipedia: ChatGPT Atlas](https://en.wikipedia.org/wiki/ChatGPT_Atlas) (read 2026-11-06)
- [OpenAI on YouTube: Introducing ChatGPT agent](https://www.youtube.com/watch?v=Wgn4JeYI9lY) (read 2026-11-06)

[Browse automations](https://mindket.com/automations)