ChatGPT Work and the Lethal Trifecta: Why Agentic AI Raises the Stakes
OpenAI's ChatGPT Work gives an agent persistent storage, code execution with internet access, and browser automation — the exact combination of capabilities that makes prompt injection dangerous.
Key Takeaways
- ChatGPT Work, announced by OpenAI on July 9th, ships as two products: a cloud version with a networked code environment and browser automation, and a desktop version (formerly Codex) that runs locally with file and program access.
- Researcher Simon Willison notes Work combines all three elements of his 'lethal trifecta' model — private data access, exposure to untrusted content, and a channel to communicate externally — the pattern that makes agents exploitable via prompt injection.
- OpenAI has not published technical detail on how Work is protected against prompt injection beyond an 'auto-review' mechanism inherited from Codex, leaving practitioners to infer the threat model from usage rather than documentation.
- Any deployment giving an LLM agent persistent storage plus outbound network access should be treated as a prompt-injection attack surface and tested accordingly, regardless of vendor assurances.
OpenAI announced ChatGPT Work on July 9th and has iterated on it heavily since. In a detailed write-up, independent researcher Simon Willison lays out what he's been able to reverse-engineer about the product — and flags a security question OpenAI hasn't clearly answered.
Two products under one name
Willison distinguishes between two distinct experiences sharing the ChatGPT Work label. Work Cloud, reachable via chatgpt.com and the mobile apps, runs in OpenAI's infrastructure with a code environment that — unlike ChatGPT's normal sandboxed container — has internet connectivity: it can clone repositories, install dependencies, and call web APIs. It also includes a full headless Chrome instance for browser automation (loading sites, filling forms, taking screenshots, manipulating the DOM), and persistent workspace storage that survives across sessions instead of the ephemeral filesystem used elsewhere in ChatGPT.
Work Local is bundled into the ChatGPT desktop app, which used to be called Codex. It gives the model direct access to files and programs on the user's own machine, wrapped in a simplified interface aimed at non-developers rather than the CLI-first Codex experience.
Why this combination matters
Willison frames the risk through his own lethal trifecta model, first described in 2025: an agent becomes dangerous when it has (1) access to private data, (2) exposure to untrusted content, and (3) a way to communicate externally. Any two of those are usually manageable; all three together mean an attacker who can get malicious instructions in front of the model — via a web page it browses, a file it reads, or an email it processes — can potentially exfiltrate whatever the agent can see. As Willison puts it: "ChatGPT Work combines all three!"
Work Cloud's networked code environment and browser automation are, by design, exposure to untrusted content (any page it loads) plus a communication channel (the internet access it needs to be useful). Work Local adds local file and program access on top. That is a materially larger attack surface than a chat window that can only read and write text.
A documentation gap, not a confirmed exploit
Willison is careful to note he hasn't demonstrated a working prompt-injection exploit against Work — his complaint is that OpenAI hasn't explained how it defends against one. He writes that he'd "love to hear more from OpenAI about how they protect ChatGPT Work sessions against prompt injection attacks," and guesses the answer is "the same auto-review mechanism as Codex," since OpenAI hasn't published anything more specific. More broadly, he criticizes OpenAI for describing Work functionally rather than technically, withholding system prompts and tool descriptions and leaving users to infer capabilities through trial and error.
The practical takeaway
For teams evaluating or deploying agentic products like this, the vendor's assurances aren't a substitute for testing. If an agent can read content you don't fully control and also has a way to send data somewhere, that pairing deserves adversarial testing before it touches anything sensitive — regardless of what the product page claims about built-in review layers.
ChatGPT Work combines all three!
— Simon Willison, on his lethal trifecta model applied to ChatGPT Work
Frequently Asked Questions
What is the difference between Work Cloud and Work Local?
Work Cloud runs in OpenAI's infrastructure with a networked code environment and browser automation, accessed via chatgpt.com or mobile. Work Local is built into the ChatGPT desktop app (formerly Codex) and can access files and programs directly on the user's own machine.
What is the 'lethal trifecta' in AI security?
It's a model described by researcher Simon Willison: an AI agent becomes exploitable when it has access to private data, is exposed to untrusted content, and has a way to communicate externally. Combining all three lets an attacker hide instructions in content the agent processes and exfiltrate data it can reach.
Has a prompt injection attack against ChatGPT Work been demonstrated?
Not that has been publicly documented as of this writing. Willison's concern is that OpenAI hasn't published technical detail on how Work is protected against prompt injection, not that a specific exploit has succeeded.
Sources
- 1Understanding ChatGPT Work — Simon Willison
- 2The lethal trifecta for AI agents: private data, untrusted content, and external communication — Simon Willison