Always-On AI Agents Explained: What to Let Them Do, and What to Keep

The short answer

Always-on AI agents are assistants that keep working between your conversations: they track tasks, follow up on schedules and act in connected apps while you are away. They are safe for research, monitoring, drafting and internal summaries. Anything that sends, pays, deletes or changes access should still wait for a person's approval.

Until recently, an AI assistant stopped the moment you stopped typing. That changed on September 29, 2026, when OpenAI introduced dots, persistent agents inside ChatGPT with their own cloud computer. Similar ideas exist elsewhere, but dots are the first version most small businesses will meet on a plan they already pay for. This guide uses them as the worked example, because OpenAI has published unusually detailed documentation on how the controls work.

What makes always-on AI agents different from a chatbot

A chatbot answers. An always-on agent owns a piece of ongoing work. OpenAI's Meet dots page describes one as "an always-on agent that keeps work moving and asks for your input when a decision needs you." Three features make that possible:

• Its own computer. A dot has a cloud computer and browser, so it "can keep working even when your computer is off."
• Memory across channels. It keeps notes on your preferences and decisions, and you can reach the same dot in ChatGPT, Slack, Teams or by call.
• Self-scheduling. It decides when to pause and resume, runs background tasks in parallel, and can set recurring check-ins.

If you are still sorting out where agents end and ordinary automation begins, our explainer on AI agents vs business automation is a useful primer. The short version: rules-based automation is predictable; an agent decides its own next step, which is both the benefit and the risk.

Jobs an always-on agent can handle well today

The best early uses share three traits: the work recurs, the output is reviewable, and a mistake is cheap to fix. Good candidates for a small or mid-size business:

• Morning briefings. A summary of overnight enquiries, calendar changes and overdue invoices, delivered before you start.
• Monitoring. Watching a competitor's pricing page, a tender portal or your review profiles and flagging changes.
• Drafting. Preparing replies, quotes or follow-up emails for you to approve, not to send.
• Research. Pulling together supplier comparisons or background on a prospect before a call.
• Chasing internal tasks. Reminding team members of open items and collecting status updates.

OpenAI's design supports this pattern. The Control your dot page notes that when a dot researches proactively in your connected apps, the tools it uses "can't send messages, change app content, or control your browser or computer." Research is read-only by design; acting is a separate step.

How approvals work, using dots as the example

Before a dot takes an action that could affect your accounts or share information, an automatic review checks it against your instructions, app permissions, custom rules and built-in safety requirements. The review then decides whether the action can proceed, needs your approval, or is a step you must do yourself. Changing a password is one example OpenAI gives of a step you always do yourself.

On top of that, you can set custom rules with four settings:

Two details are worth knowing before you rely on them. First, OpenAI is candid that custom rules "are instructions your dot tries to follow, and it can make mistakes." They don't grant access, override built-in safety requirements or remove required confirmations. Second, scope matters: "Asking your dot to draft replies doesn't give it permission to send them." Write instructions that say who, what and when.

Where always-on agents go wrong

Actions cannot be recalled

The documentation is blunt: stopping a task "doesn't undo actions it has already completed," and deleting a dot "doesn't undo changes already made in connected apps or recall messages already delivered to other people." Pausing a dot also doesn't cancel its delegated tasks or scheduled runs; those are stopped separately.

Too much access, too early

OWASP calls this Excessive Agency: damaging actions caused by an AI system with too much functionality, too many permissions or too much autonomy. A dot can connect to your apps and, optionally, one personal computer, according to OpenAI's guide to connecting computers and apps. Every connection widens what can go wrong. Our guide to AI agent permissions and identity covers how to scope that access.

Untrusted content

An agent that reads the web or your inbox will eventually read something written by an attacker. That is the prompt injection problem, and no vendor claims to have solved it outright.

Silent cost creep

Conversations with a dot don't count toward ChatGPT usage limits, but tasks it runs in Work or Codex do. Background work that nobody reviews is still work you pay for.

A starter setup for a small business

1. Start read-only. Connect calendar and email for reading and summarising first. Add write access only when you have a specific job that needs it.
2. Write one rule per risky action. "Ask before taking action" for anything a customer will see; "Hand off to you" for deletions, refunds and anything involving money.
3. Skip the personal computer at first. The cloud computer is enough for research and drafts. Connecting your own machine is optional and off by default.
4. Review the Activity and Scheduled views weekly. Cancel what you no longer need.
5. Use a business plan with admin controls if more than one person will rely on the agent. In Enterprise workspaces, dots stay off until an admin enables them.

Where to put human checkpoints in a broader workflow is its own design question; we cover it in human-in-the-loop design for AI workflows.

Key takeaways

• Always-on AI agents keep working between conversations, using their own cloud computer and memory.
• They suit recurring, reviewable, low-stakes work: briefings, monitoring, drafts and research.
• Approval rules help but are not guarantees; OpenAI says agents can make mistakes and completed actions are not undone.
• Grant read access first, write access per job, and keep money and deletions with a person.

Frequently asked questions

Are always-on AI agents the same as AI employees?

No. They handle defined tasks within the access you grant and ask for decisions they are not allowed to make. They do not carry accountability, which stays with the person or business that set them up.

Can an always-on agent use my passwords?

With dots, you enter credentials in a private sign-in form, and reusing a saved login for a new sign-in requires your confirmation. Changing a password is a step you must do yourself.

Does stopping the agent reverse what it did?

No. Stopping or deleting a dot does not undo completed actions or recall sent messages, which is why approvals belong before customer-facing or irreversible steps.

Sources

1. Meet dots — OpenAI (ChatGPT Learn)
2. Control your dot — OpenAI (ChatGPT Learn)
3. Connect computers and apps to your dot — OpenAI (ChatGPT Learn)
4. LLM06:2025 Excessive Agency — OWASP Gen AI Security Project

How Flowmatix can help

We put this into practice for businesses in Toronto and around the world through our AI Agents & AI Solutions, business process automation services. Want to know what it would take for your business? Get a personalised quote in about 3 minutes.