Willison: ChatGPT Work hits full 'lethal trifecta'

Simon Willison spent longer than he expected trying to work out what OpenAI's newest paid tier actually does, and the shape of it worries him.

In a hands-on teardown on his blog, Willison points out that "ChatGPT Work is actually two products": Work Cloud, delivered through chatgpt.com, and Work Local, a separate desktop app. Both are gated to "$20/month and up subscribers". His post focuses on Work Cloud.

What Work Cloud adds on top of regular Chat, in Willison's inventory: model choices "GPT-5.6 Sol, Luna, or Terra, each with Light, Medium, High, Extra High, Max, or Ultra reasoning levels"; a code sandbox that can hit the open internet and clone GitHub repos; a headless browser that can "load websites, fill out forms, and take screenshots"; a scratch filesystem where "each session gets its own scratch folder" named something like `/workspace/scratch/e00a0a017944`; sub-agents ("ChatGPT Chat can't run sub-agents. ChatGPT Work can."); and scheduled automations you can prompt in plain English, like a daily 8am search for a Waymo launch date in Half Moon Bay. It can also "build _and deploy_ entire websites, using Cloudflare Workers."

The problem: that feature list is the exact combination Willison has been publicly warning about. "My lethal trifecta model warns about the risks inherent in any agent system that combines access to private data with exposure to untrusted content and a way to communicate stolen information back to an attacker," he writes. On Work, his verdict is one line: "ChatGPT Work combines all three!"

He does not accuse OpenAI of shipping a broken product. He asks: "I'd love to hear more from OpenAI about how they protect ChatGPT Work sessions against prompt injection attacks." His frustration in the same post is that "OpenAI explain Work in terms of what it's for, not what it actually does", and that "OpenAI still insist on hiding their system prompts and tools descriptions". Our tracker has logged this alongside a heavy run of OpenAI shipments the security beat is picking apart in real time. Anthropic warned yesterday that infostealer malware is draining Claude sessions, which is the kind of session-exfiltration risk the trifecta describes.

"Figuring this all out took way more work than it should have," he closes.