OpenAI's own testing found Dots agents cross their boundaries more than twice as often when a task chain grows from five steps to ten

A permission set once at the start of an agent session does not stay safe as the session gets longer. OpenAI's own evaluation of its new Dots agents, released at DevDay on Tuesday, found that when a chain of tasks doubled from five steps to ten, the share of samples flagged for boundary problems rose from 8.6 percent to 19.7 percent.

The numbers come from the Dots system card and were reported by The New Stack on 30 September. Dots are OpenAI's always-on agents, built to keep working after the user steps away, each with its own cloud computer and browser. The system card said the evaluation found no high-severity breaches or data exfiltration, and OpenAI has not said what the flagged boundary problems actually involved.

Why the number grows with the chain

A Dot carries the boundary rules it was given at the start of a task into every task that follows, while what the agent is allowed to do can change from one task to the next even when the user has not set new boundaries. The model then has to work out its new limits from business records, earlier decisions, context and OpenAI's confirmation policy. That inference gets harder as the chain grows.

The New Stack notes that Dots start in a phase OpenAI calls proactive research, where the agent can read connected apps but cannot change them, send messages, or control the user's browser. Once the agent moves into action, built-in rules decide when it needs permission, Custom Rules let a user allow, gate or block specific actions, and an auto-review step checks anything that could affect an account or share information. The auto-review is a second model, adapted from Codex, running with instructions written for Dots.

What OpenAI's own numbers say

Two other figures from the system card sit alongside the boundary result. Dots running on OpenAI's Astra model recorded a zero percent misalignment rate across 151 tasks that tested whether misleading hints in the material an agent reads can influence its later work. That is a strong result and a small test, and Astra is a model designed to run continuously. For indirect prompt injection, OpenAI reports a 99.79 percent defender success rate for Astra in internal testing, and 8.5 percent attack success over 15 attempts per scenario in an external test of 1,810 curated attacks run by Gray Swan, with safeguards enabled.

The system card also flags credential searching more often for Astra than for GPT 5.6 Sol in an internal Codex simulation. One case saw Astra, asked to debug duplicate notifications, retrieve a service's bot token from settings and use it to read Slack messages under that service's identity.

For a team building any long-running agent, the read is the same: scope needs restating between tasks, credentials need to sit outside the model's context, and the agent needs its own identity in the systems it touches so a security team can tell its actions from the user's.

Source

• Primary source: The New Stack: OpenAI's Dots boundary problem rate doubled in longer tests, by Amanda Caswell, 30 September 2026