Activity for OpenClaw 2.0 and Work Cloud Push Coding Agents Beyond the Local Harness

OpenClaw 2.0 and Work Cloud Push Coding Agents Beyond the Local Harness

A practitioner-first brief on the shift from local coding harnesses to persistent, shared agent runtimes—covering Work Cloud workflows, OpenClaw 2.0, performance work, quota constraints, and the safety boundaries that make autonomy usable.

Simon Willison’s Newsletter

Theo - t3․gg

Tibo

🔥 TOP SIGNAL

The local harness is no longer the whole coding-agent unit. OpenClaw 2.0’s release post describes shared cloud sessions that let another team member join live work or take it over with the Claw’s context intact; Peter Steinberger says his team moved from local coding harnesses to team.openclaw.ai, where multiplayer coding with nodes and cloud sessions changed how they build.

Simon Willison’s Work Cloud report shows the same move from a different product: persistent scratch/workspace state, parallel sub-agents, browser and internet execution, and scheduled prompts—currently limited to $20/month-and-up subscribers. He also flags the combination of private data, untrusted content, and a channel to communicate stolen data as a “lethal trifecta”; his baseline for unattended runs is a sandbox, restricted egress, monitoring, and no home directories, SSH keys, or cloud credentials.

⚡ TRY THIS

Turn browser tasks into reproducible DOM extraction. In Work Cloud, run: Load simonwillison.net in your browser and extract the headings using JavaScript. If authentication is needed, take over for the password and 2FA; Work can then execute JavaScript through Playwright and return each heading’s level, text, and ID.
Use upstream docs as the migration spec and tests as the gate. Simon Willison’s exact Claude Code prompt was: Upgrade to anthropic>=1 - read https://raw.githubusercontent.com/anthropics/anthropic-sdk-python/refs/heads/main/MIGRATION.md and get the tests passing. The run produced PR #84 for llm-anthropic; copy the pattern for SDK upgrades: give the agent the authoritative migration document, require a passing test suite, then review the PR.
Separate event triggers from approvals. Riley Brown gave an agent an AgentMail inbox, then configured a grokbot routine of type webhook so each email received by the agent or user triggers the bot. For a purchase, the Link integration sent a phone notification and Brown explicitly approved the $22.50 charge in the Link app. Reuse the email → webhook → routine pattern, but keep money-moving actions behind a human approval step.
Reset agent instructions after model changes. Geoffrey Huntley recommends deleting agents.md and skills periodically—especially between model releases—retaining useful learnings, revalidating them every couple of months, and resisting premature standardization.

📡 WHAT SHIPPED

OpenClaw 2.0 is a broad platform release: its post credits 933 contributors, including 569 first-time contributors, and more than 16,000 pull requests across installation, messaging, memory, skills, models, automations, browser/native apps, plugins, security, and fixes. New installs can start from existing ChatGPT or Claude subscriptions, API keys, or local models; shared cloud sessions add live collaboration and context-preserving handoff.
Long-context performance is becoming a first-class product metric. Theo says T3 Code reduced worst-case long-thread data from hundreds of megabytes to just under 40 KB; Brent Traut reports that ChatGPT desktop long threads now load over 90% faster with over 90% lower memory usage. Theo’s separate measurement across most of his Codex and Claude Code threads found that only roughly 1% of response time was spent streaming text, challenging token-by-token output as a useful liveness signal.
llm-anthropic 0.27 adds compatibility with Anthropic’s anthropic v1.0.0 Python library, whose migration switched from httpx to httpx2. The release’s real-world validation is Willison’s Fable 5 run against the upstream migration guide, which produced PR #84.
Quota semantics are diverging by product and model. Tibo says paid ChatGPT Work and Codex usage was reset after the service reached a claimed 25 million active users, and clarifies that Codex “20X” labels refer to weekly limits rather than five-hour limits; he says both Pro plans currently lack five-hour limits. Theo’s report adds a model-specific Fable 5 ceiling: in his hypothetical $1,000 weekly allowance, hitting $500 of Fable forces a switch to Opus or Sonnet even while weekly capacity remains, and he says he has exhausted five Claude accounts during heavy coding weeks.
Omarchy v4.0.2 shipped another batch of security patches and minor fixes, with Ryan Hughes crediting responsible disclosures and saying the new security team aims to push findings and fixes upstream beyond Omarchy. Release.

🎬 GO DEEPER

Theo — “They lied...” — Start with the quota explanation, then the Fable allocation section. The useful distinction is between a weekly allowance and a model-specific ceiling; the latter can force fallback routing before the account’s overall budget is gone.

Study Simon Willison’s ChatGPT Work tool reference. His Work session catalogued 223 registered tools and 44 skills; the control-browser skill’s hard prerequisite is to emit and read the complete output of await browser.documentation() before using the browser API.
Study ghuntley/slopdimension. Geoffrey Huntley’s weekend project turns RSS sources into prompt-defined streaming channels, optionally regenerates historical content when a channel prompt changes, and routes both chat messages and generation prompts through a Codex-powered classifier. Its Erlang/Elixir actors, Jido, RTSP, HLS, and WebRTC stack is a compact example of putting a model-gated control layer around an automated media pipeline.

Editorial take: Today’s agent frontier is controlled persistence: durable state and handoffs are becoming the product surface, while disposable instruction files, approval-gated side effects, and sandboxed execution are the counterweights.

OpenClaw 2.0 and Work Cloud Push Coding Agents Beyond the Local Harness

Research extraction

Direct answer: OpenClaw 2.0 is presented as a broad release spanning installation, messaging, memory, skills, models, automations, browser/native apps, plugins, and security; the post links its full release notes under version 2026.8.1.

Simpler first-run setup: New installs can start from existing ChatGPT or Claude subscriptions, API keys, and local models. Initial configuration was reduced or simplified, with remaining setup deferred until after installation so users can complete it conversationally with their Claw.
Conversation-first browser workflow: The browser app was rebuilt as a first-class experience. It opens directly into a conversation and supports continuing setup, returning to ongoing work, and following work live.
Cross-channel automation workflow: The post’s examples show a Claw watching an inbox for important school messages and sending alerts to Telegram, then handling a request initiated by an iMessage by finding the relevant receipt in email and sending the answer back to the brother. These are described as conversational workflows rather than separate setup-heavy tools.
Multiplayer and handoff: Shared cloud sessions let another team member join live work or take it over while retaining the Claw’s existing context, turning OpenClaw into a collaborative workspace.
Migration detail is high-level only: The release process explicitly accounted for both fresh installs and upgrades of existing Claws, with the stated goal of avoiding a breaking update, but this source supplies no upgrade commands, compatibility matrix, rollback procedure, or other concrete migration steps.
Limits/gates: No version-specific quotas, limits, or feature gates are stated in this article; it directs readers to full release notes, which are not included in the supplied source.

OpenClaw 2.0, Accidentally

Simon Willison’s Newsletter

substack

ChatGPT Work Cloud — firsthand field report: Simon Willison says his understanding comes from “extensive experimentation” with ChatGPT Work Cloud. Work is split between Work Cloud and Work Local, the latter being the desktop app formerly called Codex; access is currently limited to $20/month-and-up plans. Work Cloud exposes GPT-5.6 Sol, Luna, and Terra with selectable reasoning levels, plus GPT-5.5; Willison believes Ultra delegates more aggressively to sub-agents. Its execution environment can access the internet, clone GitHub repositories, and install dependencies, while Claude’s equivalent container has more restricted internet access and a short domain allowlist.
Replicable workflows: For browser-based extraction, prompt Load simonwillison.net in your browser and extract the headings using JavaScript; Work launches Chrome, and the resulting Playwright code evaluates the DOM and returns each heading’s level, text, and ID. Sign-in flows can pause for the user to enter passwords and 2FA without sending those credentials through the model. Work session scratch folders persist across chats, and /workspace is shared across currently running sessions, although processes and localhost servers are not shared. Work can run parallel sub-agent sessions and recurring prompts such as run a search to see if Waymo have announced a launch date for Half Moon Bay every day at 8am; scheduled tasks can also update a ChatGPT Site. It can build and deploy sites on Cloudflare Workers with server-side Cloudflare D1/R2 features; Willison used Figure out all of the places in London with a pelican in her piety, then turn that into a JSON file and build a ChatGPT sites site about them. For tool discovery, he had Work generate a reference covering 223 registered tools and 44 skills; the control-browser skill requires reading the complete output of await browser.documentation() before using the browser API.
Critical safety counter-signal — secondhand report: Willison’s “lethal trifecta” warning applies directly to Work because it combines private-data access, exposure to untrusted content, and a channel for communicating stolen information. He reports that prompt-injection researcher Johann Rehberger found a Claude Code Opus 5 Auto Mode attack that he claims succeeds about 80% of the time: the agent is tricked into downloading and unpacking an archive, then executing code that imports an extracted local struct.py. In some runs, Auto Mode detected the compromise but blocked the cleanup command intended to terminate the malware process. The recommended baseline is to run unattended agents in a container, VM, or OS sandbox; restrict network egress; monitor execution; and withhold home directories, SSH keys, and cloud credentials. A later correction characterizes this as a confused-environment attack rather than a classic prompt injection, because the LLM did not directly follow malicious website instructions. Separately, rclone maintainer Nick Craig-Wood reports more than 40 security disclosures in one month versus about 20 across the project’s first decade, using AI tools to triage disclosures and propose fixes for review; roughly 75% contained something worth investigating.
Concrete Claude Code migration workflow — firsthand:llm-anthropic 0.27 updates Simon Willison’s Anthropic plugin for compatibility with the anthropic v1.0.0 Python library, which switched from httpx to httpx2. He used Fable 5 in Claude Code with the prompt Upgrade to anthropic>=1 - read https://raw.githubusercontent.com/anthropics/anthropic-sdk-python/refs/heads/main/MIGRATION.md and get the tests passing, producing PR #84.
Reusable verification pattern: In a quoted observation, Paul Dix argues that agents can produce sophisticated reliable software when given proper direction plus a verification system and repeated refinement; he cites AI-written 1M LOC software now running on millions of developer machines.
Model-watch signals, with limited coding evidence: Willison tested the open-weight multimodal Qwen3.8-Flash-Next on a DGX Spark using 72.5GB and 78.9GB Unsloth GGUF quantizations and an xhigh reasoning effort, but the reported task was SVG generation. Tencent’s open-weight Hy4 Preview is text-only, has 770B total and 49B active parameters with a 1M-token context, and its chat template exposes only high reasoning by default or no_think; Willison likewise tested it with an SVG prompt.

Understanding ChatGPT Work

Theo - t3․gg

youtube

Cursor/OpenAI access change (Theo’s report): OpenAI plans to wind down its contract supplying models through Cursor, with a proposed shutdown date of November 12, 2026. Cursor users should be able to retain access by using their own OpenAI API key or OpenAI’s IDE extension inside Cursor; Theo also says OpenAI told him T3 Code will continue to be supported. Practical mitigation: configure and test a direct API-key or IDE-extension fallback instead of relying only on Cursor’s bundled provider access.
Evaluate agents on cost and token efficiency, not benchmark score or traffic share alone: Theo says Cursor’s reported 5% OpenAI traffic figure is ambiguous because it could mean users, requests, or tokens. He cites large per-task differences between the models he calls “Fable” and “Soul”—roughly 17k versus 36k tokens/task in one analysis and 28k versus 103k in Cursor Bench—alongside scores of 70.5% versus 67.2% and quoted run costs above $3 versus below $1. His actionable takeaway is to track tokens and cost per completed task alongside quality.
Orchestration pattern: Theo’s contrarian observation is that falling back to a weaker model requires the developer to manually decide how to decompose work, route each piece, and audit the results; stronger frontier models reduce that burden and have changed his workflow for real projects. For a unified interface while using direct provider subscriptions, he points to Gene, Superset (open-source, terminal-focused), Herder (open-source, tmux-like), and T3 Code (free and open source).
Source context: Theo says he was an early Cursor investor and has helped the Cursor team for nearly four years; he presents the model comparison as day-to-day experience writing and landing code, while disclosing his financial connection to Cursor.

Well This Was Unexpected...

Theo - t3․gg

youtube

Claude Code quota change: Anthropic said the temporary 50% weekly-limit increase would remain until September 14, after which standard weekly limits for Pro Max and seat-based enterprise plans would be permanently 25% higher than the prior baseline—effectively about 17% below the temporary limits.
Model-specific quota planning: Theo says that after Fable 5 returned, it received a separate allocation rather than access to the full weekly allowance; in his example, reaching a $500 Fable 5 cap within a $1,000 weekly allowance forced the user onto Opus or Sonnet for the remainder. Developers dependent on Fable 5 should therefore plan a fallback model instead of assuming unused weekly quota means continued Fable access.
Firsthand model assessment: Theo says he maintains five Claude accounts and has exhausted all of them during heavy coding weeks. He considers Fable 5 good enough to justify the subscription, while judging Opus and Sonnet poor by comparison; this is a personal practitioner assessment, not a benchmark.
Codex comparison: Theo reports that Codex’s $100 and $200 subscriptions had no five-hour limits at the time of recording, although he cautions that their weekly allowance could still be consumed easily.

Anthropic Is "Increasing" Your Limits

Salvatore Sanfilippo

Profile

Dwarf Star agent workflow. Salvatore Sanfilippo says, as the software’s author, that he wrote no code for Dwarf Star and contributed ideas; he believes an agent could already automate much of his remaining work. The proposed loop is to monitor promising releases against predefined quality criteria, test local language models as a user while measuring speed and output quality, fetch the latest updates and apply optimizations, evaluate new local-inference hardware, and email a recommendation. He presents this as a vertical, prestructured workflow with many executable “rails,” and says it is nearly possible today—an orchestration pattern of discovery → evaluation → optimization → infrastructure recommendation, not a reported production deployment or benchmark.
Speculative context-management pattern. Sanfilippo imagines an LLM retaining an experience stream or vector beyond its active context, so context compaction would leave a residual representation of the session’s overall history; this global state could help correct cases where individual decisions are locally strong but globally inconsistent.

Stiamo per rompere col passato, per sempre

geoff

Geoffrey Huntley proposes a contrarian agent-era standard: code does not need to be understandable line by line by humans; it needs to be explainable on demand, for example by prompting, “yo, explain this grammar.”

Fireside Alpha, quoting SemiAnalysis’s Jordan Nanos, describes OpenAI engineers who could not explain DeepSeek’s MLA kernel line by line, while AI-generated code in Gluon—a low-level language built on Triton—was tested by the AI and produced kernels reported as correct and high-performing. The practical pattern is to use automated correctness/performance results as the acceptance gate for opaque generated code, with on-demand explanations providing human oversight rather than requiring initial line-by-line comprehension.

code does not need to be understandable by humans. it needs to be explainable to humans. why are humans the definition/target for languag… SemiAnalysis' Jordan Nanos reveals the OpenAI engineers scrolling their own kernel code had no idea what it did line by line, and it didn…

Simon Willison

In a firsthand experiment, Simon Willison found that ChatGPT Work adds capabilities beyond regular ChatGPT: switching among Sol, Luna, and Terra; internet-enabled code execution; a headless Chrome browser; a persistent filesystem shared across sessions; publishable ChatGPT Sites; sub-agent sessions; and scheduled prompt automations.
Replicable tool-discovery workflow: prompt Work to “Build a site that lists every one of your tools,” grouping them by category and reproducing exact tool descriptions and TypeScript argument declarations where possible. Work reportedly built and published the resulting Codex Tool Reference in 9 minutes 12 seconds; the generated reference states that it covers 232 interfaces—223 registered tools and 9 direct orchestration controls—across 24 purpose-based categories.

Here's my attempt at explaining what ChatGPT Work can actually do - it's a deeply confusing but extremely powerful tool with a whole lot … Bonus: I ran this prompt and had ChatGPT Work build me a ChatGPT Site listing all of its available tools along with their descriptions [h…

Kent C. Dodds 🐨

Kent C. Dodds reports that OpenClaw 2 has been released and says it “works great with” @kodykoala.
He links to the follow-up post “OpenClaw 2 Needs a Home”.

OpenClaw 2 has been released and it works great with [@kodykoala](https://x.com/kodykoala) [https://kody.codes/blog/openclaw-2-needs-a-ho…

geoff

Geoffrey Huntley describes a firsthand weekend project, Slopdimension, that turns RSS feeds into AI-generated streaming channels. It includes three prebuilt channels, lets users register channels with custom prompts grounding each channel in a chosen style/reality, and can optionally regenerate historical content when an administrator changes a channel prompt.
The system passes all chat messages and generation prompts through a classifier powered by Codex, illustrating a model-gated control layer around both user input and content generation.
Huntley’s proposed technical stack uses Erlang/Elixir actors, Jido, RTSP, HLS, and WebRTC; he says the system could likely support 100k+ concurrent viewers with correct deployment and very substantial GPU capacity—a conditional scaling estimate, not a reported benchmark. The project repository is https://github.com/ghuntley/slopdimension.

alright, it's been a fun little weekend project hacking on "a slop version of comcast" comes with with three prebuilt channels which inge…

geoff

Geoffrey Huntley’s factory-productization thesis: factories are difficult but not impossible to turn into products; instead of selling the end product built by the factory, sell integration-ready components that enable others to create that outcome. He links to RAD as a resource.

alright here’s another hot take factories are hard to turn into products, not impossible, what ya gotta do is build components for integr…

Peter Steinberger 🦞

Peter Steinberger describes a firsthand team workflow for building OpenClaw with OpenClaw: over two months, the team moved from individual local coding harnesses to team.openclaw.ai, a shared agent that tracks what everyone is working on and orchestrates the work.
The shared setup combines multiplayer coding with nodes and cloud sessions to provide effectively unlimited compute; Steinberger says this changed how the team builds and now views local harnesses as obsolete.
The related project announcement states that OpenClaw 2.0 has arrived: https://openclaw.ai/blog/openclaw-2-accidentally

Two months ago, we started the mission to “build OpenClaw with OpenClaw,” and bit by bit, we moved everyone from using their local coding… OpenClaw 2.0 has arrived [https://openclaw.ai/blog/openclaw-2-accidentally](https://openclaw.ai/blog/openclaw-2-accidentally)

DHH

Jason Fried’s firsthand workflow: He built his first Omarchy plugin entirely with AI, using only back-and-forth in English and no other medium.
Concrete outcome: DHH says he introduced Jason to coding agents on Saturday, after which Jason built a new world clock on Sunday that is planned for Omarchy 4.1.

Just built my first Omarchy plugin! This also happens to be the first piece of software I've ever made solo entirely with AI. Back-and-fo… I got Jason agent pilled on Saturday and on Sunday he built the new world clock that'll ship with Omarchy 4.1!! This is the next phase of…

Riley Brown

Human-in-the-loop payments: @rileybrown reports a firsthand workflow in which an agent on @bot uses the Link integration to request a purchase; the user receives a phone notification, approves the $22.50 charge in the Link app, and the item is scheduled to arrive the next day.
Email-triggered agent orchestration: Brown gave the agent an email address through AgentMail, then configured grokbot’s webhook routine so every email received by the agent—or by the user—triggers a bot routine. Replicable pattern: AgentMail inbox → webhook event → grokbot routine.

The next 12 months are going to be wild... Today I gave my agents a credit card and an email... I just set up the [@link](https://x.com/l…

Theo - t3.gg

Theo reports that the T3 Code team spent a week reducing the data required to load long threads, taking worst-case usage from hundreds of megabytes to just under 40 KB. He describes long-thread performance as essential for larger, harder tasks and says concerns about performance regressions helped motivate making T3 Code open source.
As a reported comparison, Brent Traut says a ChatGPT desktop change made long threads load over 90% faster while reducing their memory footprint by over 90%. Together, these accounts point to long-thread data loading and memory usage as first-class constraints for coding-agent workflows.

This isn't easy to do. We had an unfair advantage with T3 Code (we knew long threads were a thing already) and we still got it wrong. I s… Last week, I pushed a change to the ChatGPT desktop app that makes the loading of threads faster. Not just a little faster. A LOT faster.…

geoff

Geoffrey Huntley recommends periodically deleting agents.md and skills—especially between model releases—then retaining only useful learnings and revalidating them every couple of months. His rationale is that improving models may require less manual configuration to achieve desired outcomes and behaviors. He also cautions that it is still “WAY too early for standardisation,” arguing against prematurely locking in agent conventions.

one thing i wish more folks understood you should be deleting your agents md and skills on the often. especially between model releases t…

Theo - t3.gg

Claude Code’s standard weekly limits will be permanently raised by 25% for Pro, Max, Team, and seat-based Enterprise plans starting September 14; the currently active 50% increase remains in place until then. This is a product-capacity update relayed by Theo, not a firsthand workflow or productivity report.

Starting September 14, we're permanently raising standard weekly limits in Claude Code by 25% for Pro, Max, Team, and seat-based Enterpri… Anthropic increased Claude Code rate limits by -17%! Wait that's not right... [![Video](https://pbs.twimg.com/amplify_video_thumb/2094234…

Armin Ronacher ⇌

Armin Ronacher flags OpenClaw as markedly different from what users might remember from “5 AI years ago.” The linked comparison from Peter Steinberger favors moving beyond CLI-only interaction toward UI visualizations and an integrated team workspace: “cli is nice, having UI visualizations and your team where you work is nicer.”

OpenClaw looks quite a bit different than what you might remember from … checks clock … 5 AI years ago. [https://x.com/steipete/status/20… cli is nice, having UI visualizations and your team where you work is nicer. ![](https://pbs.twimg.com/media/HQcInPOasAANya1.jpg)

Theo - t3.gg

Theo’s firsthand measurement of real-world requests across most of his threads in Codex and Claude Code found that roughly 1% of response time is spent streaming text back to him. This challenges using visible token streaming as a reliable signal that an agent is still running.

I ran some fun numbers here on real-world requests for the majority of my threads in Codex and Claude Code. Roughly 1% of the response ti…

Theo - t3.gg

Theo’s firsthand measurement of real-world requests across most of his Codex and Claude Code threads found that roughly 1% of response time is spent streaming text back to him . He questions streaming as a useful signal that an agent is still working and prefers receiving a complete paragraph or block once finished instead of token-by-token output .

I ran some fun numbers here on real-world requests for the majority of my threads in Codex and Claude Code. Roughly 1% of the response ti… Hot take: I don’t want responses streamed anymore. Just give me the whole paragraph/block when it is done. [https://x.com/claudedevs/stat…

Riley Brown

Riley Brown highlights Codex’s built-in diagram skill as a useful aid for understanding complex topics; developers can use it when working through difficult code or system concepts.

The built in diagram skill inside codex is very useful for understanding complex topics. [![Video](https://pbs.twimg.com/amplify_video_th…

Understanding ChatGPT Work

Open on simonw.substack.com Open 1 day ago

Simon Willison’s Newsletter Substack publication

1 of 25 highlights

In this newsletter:

Understanding ChatGPT Work

Plus 6 links and 1 quotation and 1 release

Sponsor message: Static code review has a ceiling. It can reason about what the code says. It can’t tell you what it does. TREX (opens in new tab) (which stands for “Test, Run, Execute”) is Greptile’s response to that ceiling: an execution layer built directly into code review. Try it for free (opens in new tab).

Understanding ChatGPT Work (opens in new tab) - 2026-08-30

OpenAI announced ChatGPT Work (opens in new tab) on July 9th, and have been furiously iterating on it ever since. It is an extraordinarily confusing and very powerful product. Here’s what I’ve figured out about it so far.

ChatGPT Work is actually two products

The more interesting version of ChatGPT Work is the one that runs in the cloud. This can be accessed via chatgpt.com (opens in new tab) or through the ChatGPT mobile apps. Let’s call it Work Cloud.

If you install the ChatGPT desktop app - the app that used to be called Codex - you gain access to a thing called ChatGPT Work that can access files and run programs directly on your computer. Let’s call that one Work Local. This one feels more like regular Codex re-skinned to be less intimidating to non-software-developers.

For the rest of this article I’m going to talk exclusively about Work Cloud.

Work is for paid subscribers only

Right now, ChatGPT Work (in both flavors) is available only to \$20/month and up subscribers. Free users and \$8/month Go users do not have access.

Work has features that aren’t available in Chat

The interface for accessing Work is a tab selector, which presents it as an alternative to Chat:

ChatGPT app header with a Chat and a Work tab

The obvious question is when should I use Chat, and when should I use Work?

OpenAI’s official answer (opens in new tab) to that question is:

Use Chat when you want an answer, explanation, brainstorm, or short draft. Use ChatGPT Work when you want ChatGPT to complete a task with a clear outcome, such as a brief, deck, analysis, recurring update, workflow, or file you can review and use.

I find that almost entirely useless, because I’ve been using regular ChatGPT Chat for all of those task categories for years!

The better question then is what features does Work have that are missing from Chat?

After extensive experimentation I think I’ve mostly figured that out:

Model selection

In Work, you get the option to pick GPT-5.6 Sol, Luna, or Terra, each with Light, Medium, High, Extra High, Max, or Ultra reasoning levels. You can also pick GPT-5.5 at Light, Medium, High, or Extra High.

These look to be the same models that are available through the OpenAI API.

Chat offers a different selection: 5.6 Instant, Medium, High, Extra High, and Pro (actually Extra High and Pro are only available for \$100/month+ subscribers - \$20/month subscribers cap out at High). It doesn’t explain if those are Luna or Terra or Sol (I’m assuming Sol?). 5.6 Pro appears to be exclusive to Chat, with no equivalent in Work.

My current understanding from using Codex is that Ultra is a special mode that more eagerly delegates to sub-agents.

I believe ChatGPT Work sessions are billed against your Codex allowance, while ChatGPT Chat Sessions get their own, separate allowance. This may help explain the model availability differences.

Code execution with Internet access!

As a long-time fan of the Code Interpreter pattern (opens in new tab) - pioneered by OpenAI in 2023 - this is by far the most exciting feature of ChatGPT Work (Cloud) for me.

The code execution environment can now talk to the rest of the internet!

ChatGPT Chat can’t do this - if you ask it to install additional software packages or interact with websites or APIs that access will be blocked by the container proxy.

(Weirdly, back in January it grew the ability to install packages (opens in new tab), but that doesn’t seem to work any more. I wish they had better changelogs!)

Claude’s equivalent container has allowed restricted internet access since it launched last September (opens in new tab). Claude can install packages from PYPI and NPM and clone repositories from GitHub. But that is about it: the allowlist of domains is very short.

ChatGPT Work allows a whole lot more than that. It can be configured with a specific list of allowed domains, but the default appears to be open to all.

This makes Work an incredibly useful tool. You can have it clone GitHub repositories, install their dependencies, then use them to interact with the rest of the web!

A full, headless Chrome browser

Another killer feature of ChatGPT Work is the browser tool (opens in new tab). ChatGPT Work can launch a full Chrome instance, load websites, fill out forms, and take screenshots.

Screenshot of a ChatGPT conversation. A user message in a black rounded bubble reads: Visit https://london-pelicans-in-her-piety.simonw.chatgpt.site/ and take a screenshot with you browser. Below it a collapsed status line reads "Worked for 1m 18s >", followed by the reply "Here's the screenshot of the live site:" and an embedded screenshot of a website.

If a site requires sign in the browser can prompt you to take over and enter both passwords and 2FA codes, without round-tripping those credentials through the model itself.

It can even run JavaScript against the DOM of loaded pages. I prompted:

Load simonwillison.net in your browser and extract the headings using JavaScript

ChatGPT Work fired up a browser instance and ran the code:

await tab.playwright.evaluate(() => {
  return Array.from(document.querySelectorAll(”h1,h2,h3,h4,h5,h6”), heading => ({
    level: heading.tagName.toLowerCase(),
    text: heading.innerText.trim().replace(/\s+/g, “ “),
    id: heading.id || null
  }));
});

This feels a lot like my shot-scraper javascript (opens in new tab)tool, only now I can access it on my phone!

A persistent, shared filesystem

ChatGPT Chat gets a fresh filesystem for each chat session. These cannot be accessed from any other session.

In ChatGPT Work each session gets its own scratch folder - named something like /workspace/scratch/e00a0a017944 - but each of those are persisted across sessions, so you can access files from previous chats. I have 171 folders in /workspace/scratch right now!

As far as I can tell that /workspace volume is mounted to all Work sessions that are currently running - file edits from one can be instantly seen by the others. They don’t seem to share the same process space though, and localhost servers running in one can’t be accessed from another.

ChatGPT Sites

ChatGPT Work has the ability to build and deploy entire websites, using Cloudflare Workers. These can have HTML and JavaScript and can run server-side features too, including stateful features on top of Cloudflare D1 and R2.

Here’s a simple site I built with this feature:

london-pelicans-in-her-piety.simonw.chatgpt.site (opens in new tab)

My prompt was:

Figure out all of the places in London with a pelican in her piety, then turn that into a JSON file and build a ChatGPT sites site about them

(A pelican in her piety is a fascinating piece of medieval Christian imagery (opens in new tab) - once you know about them you’ll find them all over the place.)

These sites default to being private to the user that created them, but you can make them public and (on team plans) share them with other specific individuals.

Sub-agents with Sol, Luna, and Terra

There’s not much to say about this one. ChatGPT Chat can’t run sub-agents. ChatGPT Work can. This is very much a power-user feature: if you are running a complex project that can benefit from multiple parallel agents working together, Work can do that.

Scheduled prompt automations

Another feature that seems to have migrated from regular ChatGPT to ChatGPT Work at some point. You can prompt ChatGPT Work like this:

run a search to see if Waymo have announced a launch date for Half Moon Bay every day at 8am

This will schedule a prompt to run on that frequency. These prompts can decide that nothing interesting has happened, or they can decide to notify you of some new information.

Update: Actually this seems to work in ChatGPT Chat as well.

It’s still worth noting here though, as it can be used in conjunction with other ChatGPT Work exclusive features. You can set a scheduled task to update a ChatGPT Site on an hourly basis, for example.

Is this safe?

An open question for me right now is how safeall of this stuff is.

My lethal trifecta model (opens in new tab) warns about the risks inherent in any agent system that combines access to private data with exposure to untrusted content and a way to communicate stolen information back to an attacker.

ChatGPT Work combines all three!

I’d love to hear more from OpenAI about how they protect ChatGPT Work sessions against prompt injection attacks. I expect their answer is the same auto-review mechanism (opens in new tab) as Codex.

OpenAI could make this a lot less confusing

Figuring this all out took way more work than it should have.

I think there are two key problems here:

OpenAI explain Work in terms of what it’s for, not what it actually does
OpenAI still insist on hiding their system prompts and tools descriptions

If the ChatGPT Work documentation included the exact system prompt and tool descriptions used by the agent I wouldn’t have needed to write this post.

A list of all the tools

Shortly after publishing this article I had an idea. I started a fresh Work session and prompted:

Build a site that lists every one of your tools - nearly grouped into categories - and for each one explain what it does. Try to exactly duplicate arguments and tool descriptions where possible. Design aesthetic should be technical docs, minimal flare

Here’s the site it built (opens in new tab), which includes details of 223 registered tools - though 6 of those are from my own personal MCPs served via datasette-mcp (opens in new tab).

And a whole lot of Skills

I noticed that the only browser-related tool in the list was web.run (opens in new tab), which has methods for running searches, opening URLs, and clicking links, but didn’t look like the full story in regards to headless browser automation.

This made me suspicious that something was missing, so I told the ChatGPT Work session that built that tools reference site:

Add full copies of every skill to the website (separate pages linked to from the homepage)

It turns out ChatGPT Work uses a lot of skills (opens in new tab) - 44 in fact!

The control-browser skill (opens in new tab) explains how the browser works:

Run browser setup code through the Node REPL js tool. In this environment the callable tool id typically appears as mcp__node_repl__js. […]
The ability to interact directly with the browser is exposed through the browser-client runtime via the agent.browsers.* API. Before trying to interact with it, you MUST emit and read the complete documentation returned by await browser.documentation() in one go.

So I told Work:

Add the full output of await browser.documentation() to the bottom of the /skills/control-browser page

And now you can read that on /skills/control-browser (opens in new tab) as well.

A few more interesting Skills:

documents (opens in new tab) for creating .docx files
imagegen (opens in new tab) with tips on creating images with the image_gen tool
pdf (opens in new tab) for both reading and rendering PDFs
Spreadsheets (opens in new tab) for manipulating .xlsx, .xls, .csv, .tsv
sites:sites-building (opens in new tab) for creating ChatGPT Sites
openai-docs (opens in new tab) for answering questions about itself
data-analytics:build-dashboard (opens in new tab) for building data dashboards

Link 2026-08-24 Your executable is a SQLite database (opens in new tab):

Farid Zakaria describes a neat Linux pattern for creating a SQLite database file that can be directly used as an executable binary.

The trick sets the SQLite file format’s 4-byte application ID (68 bytes into the file) to SELF, standing for Structured Executable & Linkable Format. The various components of the ELF executable format are then arranged into a number of different SQLite tables, using this schema (opens in new tab).

Their self-exec interpreter (C code here (opens in new tab)) can then extract and execute the necessary pieces.

You can additionally use a Linux mechanism called binfmt_misc (opens in new tab) to teach the kernel to execute that any time it encounters an executable matching that binary pattern. Farid uses NixOS here, but without NixOS I think registration looks something like this:

printf '%s\n' ':self:M:68:SELF::/usr/local/bin/self-exec:'

  > /proc/sys/fs/binfmt_misc/register

Release: llm-anthropic 0.27 (opens in new tab)

This release of the Anthropic plugin for LLM (opens in new tab)mainly provides compatibility with the recently released anthropic v1.0.0 (opens in new tab) Python library, which switches from httpx to httpx2 (opens in new tab). OpenAI made the same change in their v3.0.0 release (opens in new tab) two weeks ago.

Anthropic provide this migration guide (opens in new tab) for upgrading to 1.0, so I prompted Fable 5 in Claude Code with:

Upgrade to anthropic>=1 - read https://raw.githubusercontent.com/anthropics/anthropic-sdk-python/refs/heads/main/MIGRATION.md and get the tests passing

Here’s the resulting PR (opens in new tab).

Link 2026-08-25 EVE Online: The Move to Python 3 Begins! (opens in new tab):

EVE Online has been one of the most interesting case studies in Python at scale for over twenty years now.

They’ve been running on Stackless Python (opens in new tab)since their launch in 2003, and their last major upgrade was 16 years ago, to Stackless Python 2.7 in 2010 (opens in new tab).

Their upgrade to Python 3 will start using the futurize (opens in new tab) script against 2.4 million lines of code, followed by careful manual review of the ~20,000 places where Python 2 and 3 behavior differ - for example 1 / 2 is 0 in Python 2 but is 0.5 in Python 3.

There’s nothing in this announcement about how they plan to replace Stackless, but at their conference last year they presented Scheduling in Carbon: Leaving Stackless Python Behind (opens in new tab) describing how they replaced Stackless in the Carbon engine for their more recent game EVE Frontier, using their (now open source) carbonengine/scheduler (opens in new tab) library.

Quote 2026-08-26

The fact that AI wrote 1M LOC and then refined it over the course of the next couple of months to produce a reliable piece of software that is currently running on millions of developer machines is absolutely mind blowing. And you can say, “well it’s not that impressive because they had an oracle to compare against, so it was simple to go from one language to another”, but I think that’s selling this entire thing short. If you can build a verification system and give proper direction, AI can produce a highly complex, highly sophisticated piece of software and it can continue to refine it until it just works.

Paul Dix (opens in new tab), The end of programming

Link 2026-08-26 Qwen3.8-Flash-Next (opens in new tab):

Another open weights model from Qwen. This one is “a multimodal MoE model that also serves as an early preview of the architecture used in Qwen4”.

It’s pretty big: 125B tokens, but only 6B active which means it gets a significant performance boost.

I’ve been trying it out on a DGX Spark using these Unsloth quantized models (opens in new tab). I’m still exploring the model - so far I’ve tried the 72.5GB UD-IQ1_S one (producing these pelicans (opens in new tab)) and the 78.9GB UD-Q2_K_XL (producing these (opens in new tab)).

My favorite so far was this xhigh reasoning effort one from UD-Q2_K_XL:

Flat vector illustration: a white pelican with an orange beak and orange legs rides a red bicycle along a sandy path, a wicker basket on the handlebars holding a blue fish, with green rolling hills, a small tree and bushes, white clouds and a bright yellow sun in a blue sky behind it

Link 2026-08-27 Breaking Claude Code Opus 5 Auto Mode (opens in new tab):

Anthropic are putting a great deal of faith in Claude Code’s auto mode for protecting their coding agent users against prompt injection attacks. They recently made that the default (opens in new tab)and have made bold claims about its effectiveness.

Johann Rehberger is one of the most credible prompt injection researchers active today. He found an attack against auto mode which he claims works 80% of the time, by tricking Claude Code into downloading and uncompressing a zip archive, then executing code that imports base64 without noticing that this will import and execute a local struct.pyfile extracted from the archive.

In a few cases auto mode directly prevented the agent from preventing harmful code from continuing to execute!

In a few runs Claude tried to terminate the malware process once it noticed the compromise, but Auto Mode denied the cleanup command.
Claude detects the compromise, but Auto Mode blocks its cleanup command
The safety mechanism itself can become part of the failure. The classifier allowed the creation of the malware process, but then it blocked the command intended to stop it!

I agree with Johann’s conclusion here: the only safe way to run agents if there’s any risk of attracting the attention of an adversarial attack is with a sandbox:

Run unattended coding agents in a container, VM or OS sandbox.
Restrict network egress.
Monitor your agents.
Do not expose home directories, SSH keys, cloud credentials,… to the agent runtime. […]

Update 30th August 2026: On Lobste.rs hyperpape points out (opens in new tab) that this doesn’t fit the bill of a classic prompt injection attack because at no point are malicious instructions from the website accidentally followed by the LLM. They’re right: this is more of a confused environment attack where the nature of the environment that the agent is exposed to results in an exploit.

Link 2026-08-28 Just a rumour of a bug is enough to find a security exploit these days (opens in new tab):

Anil Madhavapeddy is a professor of computer science at Cambridge and a core maintainer of the OCaml compiler. In this somewhat alarming post he reports that security issues in OCaml projects are seeing evidence of attempted exploits within minutes of patches being shared for discussion:

This normally takes a few days and a release within a week or two is reasonable. Within about ten minutes (!) this website was fielding probes for percent-encoded traversal sequences, indicating that automated watchers are keeping an eye on public repositories.

Modern coding agents have become so effective at finding flaws that the slightest hint at a new bug can be enough information for them to find it, something Anil has been able to demonstrate using his own agents, switching to DeepSeek V4 Pro⁠ when Claude Fable refused the task.

Anil points out that this rate of discovery appears incompatible with existing open source embargo practices for new issues. If an issue can become an exploit this fast, we need to figure out new processes for keeping our communities safe.

rclone maintainer Nick Craig-Wood confirms in the Hacker News comments (opens in new tab) that his project is seeing this problem:

In the first 10 years of the rclone project we received about 20 security disclosures through GitHub. We had to deal with over 40 in the last month! That has taken a huge amount of my time, even using AI tools to triage and come up with fixes for review.
The hit rate for those security disclosures is pretty good - about 75% of them have a nugget of something which needs looking at. […]
GitHub assigns CVEs for the advisories. Before the AI apocalypse they took 2-3 days for an assignment but now it they are running at 3-4 weeks so I have to send the point releases out with CVE-PENDING in the changelog which isn’t ideal.

Link 2026-08-29 Introducing Hy4 Preview (opens in new tab):

New open weight text input (no vision) LLM from Chinese company Tencent today: 770B total parameters, 49B active parameters, 1M token context window, 1.56TB on Hugging Face (opens in new tab).

This is a big size increase from their previous Hy3 (opens in new tab) in July, which was 295B, 21B active, 256,000 context, 598GB.

I recently started using model chat templates to better understand their capabilities. Here’s Hy4’s chat_template.jinja (opens in new tab) on Hugging Face, which includes this section:

{%- if not reasoning_effort is defined %}
    {%- set reasoning_effort = ‘high’ %}
{%- elif reasoning_effort not in [‘high’, ‘no_think’] %}
    {%- if reasoning_effort is none %}
        {{- raise_exception(’reasoning_effort error : None, should be no_think/high’) }}
    {%- else %}
        {{- raise_exception(’reasoning_effort error : ‘ + reasoning_effort + ‘, should be no_think/high’) }}
    {%- endif %}
{%- endif %}

So it looks like there are just two reasoning effort levels: “high” (the default) and “no_think” (reason by disabled).

I tried my “Generate an SVG of a pelican riding a bicycle” prompt with the default high reasoning via OpenRouter (opens in new tab) and got this (opens in new tab):

Flat vector cartoon illustration of a white pelican with a large orange bill riding a red bicycle to the right along a grey road with a dashed white centre line, its orange webbed feet on the pedals and grey tail feathers fanned out behind, against a pale blue sky with a yellow sun, white clouds and horizontal white motion lines suggesting speed

Quoting the reasoning trace:

[…] Let’s maybe add a helmet? It could improve riding theme, but may obscure head. Maybe a small cycling cap or helmet? The user didn’t ask; can add red helmet? Might be cute. But pelican with big beak; a helmet might obscure. Better maybe no.
Maybe add sunglasses? no.
Maybe add water? no.

It’s interesting how the reasoning trace uses slightly truncated English, presumably because perfect grammar isn’t useful or token efficient for hidden reasoning text.

If you find this newsletter useful, please consider sponsoring me via GitHub (opens in new tab). \$10/month and higher sponsors get a monthly newsletter with my summary of the most important trends of the past 30 days - here are previews from April (opens in new tab) and May (opens in new tab) and June (opens in new tab).

Insights

Simon Willison’s Newsletter https://simonw.substack.com

ChatGPT Work Cloud — firsthand field report: Simon Willison says his understanding comes from “extensive experimentation” with ChatGPT Work Cloud. Work is split between Work Cloud and Work Local, the latter being the desktop app formerly called Codex; access is currently limited to $20/month-and-up plans. Work Cloud exposes GPT-5.6 Sol, Luna, and Terra with selectable reasoning levels, plus GPT-5.5; Willison believes Ultra delegates more aggressively to sub-agents. Its execution environment can access the internet, clone GitHub repositories, and install dependencies, while Claude’s equivalent container has more restricted internet access and a short domain allowlist.
Replicable workflows: For browser-based extraction, prompt Load simonwillison.net in your browser and extract the headings using JavaScript; Work launches Chrome, and the resulting Playwright code evaluates the DOM and returns each heading’s level, text, and ID. Sign-in flows can pause for the user to enter passwords and 2FA without sending those credentials through the model. Work session scratch folders persist across chats, and /workspace is shared across currently running sessions, although processes and localhost servers are not shared. Work can run parallel sub-agent sessions and recurring prompts such as run a search to see if Waymo have announced a launch date for Half Moon Bay every day at 8am; scheduled tasks can also update a ChatGPT Site. It can build and deploy sites on Cloudflare Workers with server-side Cloudflare D1/R2 features; Willison used Figure out all of the places in London with a pelican in her piety, then turn that into a JSON file and build a ChatGPT sites site about them. For tool discovery, he had Work generate a reference covering 223 registered tools and 44 skills; the control-browser skill requires reading the complete output of await browser.documentation() before using the browser API.
Critical safety counter-signal — secondhand report: Willison’s “lethal trifecta” warning applies directly to Work because it combines private-data access, exposure to untrusted content, and a channel for communicating stolen information. He reports that prompt-injection researcher Johann Rehberger found a Claude Code Opus 5 Auto Mode attack that he claims succeeds about 80% of the time: the agent is tricked into downloading and unpacking an archive, then executing code that imports an extracted local struct.py. In some runs, Auto Mode detected the compromise but blocked the cleanup command intended to terminate the malware process. The recommended baseline is to run unattended agents in a container, VM, or OS sandbox; restrict network egress; monitor execution; and withhold home directories, SSH keys, and cloud credentials. A later correction characterizes this as a confused-environment attack rather than a classic prompt injection, because the LLM did not directly follow malicious website instructions. Separately, rclone maintainer Nick Craig-Wood reports more than 40 security disclosures in one month versus about 20 across the project’s first decade, using AI tools to triage disclosures and propose fixes for review; roughly 75% contained something worth investigating.
Concrete Claude Code migration workflow — firsthand:llm-anthropic 0.27 updates Simon Willison’s Anthropic plugin for compatibility with the anthropic v1.0.0 Python library, which switched from httpx to httpx2. He used Fable 5 in Claude Code with the prompt Upgrade to anthropic>=1 - read https://raw.githubusercontent.com/anthropics/anthropic-sdk-python/refs/heads/main/MIGRATION.md and get the tests passing, producing PR #84.
Reusable verification pattern: In a quoted observation, Paul Dix argues that agents can produce sophisticated reliable software when given proper direction plus a verification system and repeated refinement; he cites AI-written 1M LOC software now running on millions of developer machines.
Model-watch signals, with limited coding evidence: Willison tested the open-weight multimodal Qwen3.8-Flash-Next on a DGX Spark using 72.5GB and 78.9GB Unsloth GGUF quantizations and an xhigh reasoning effort, but the reported task was SVG generation. Tencent’s open-weight Hy4 Preview is text-only, has 770B total and 49B active parameters with a 1M-token context, and its chat template exposes only high reasoning by default or no_think; Willison likewise tested it with an SVG prompt.

Understanding ChatGPT Work