OpenAI launches Operator, an AI agent that browses the web for you

For the past two years, AI has mostly been a talker. You ask ChatGPT to plan a weekend getaway, and it hands you a beautiful itinerary, but you still have to open five tabs to actually book the hotel, buy the tickets, and reserve dinner.

Now OpenAI wants to handle the tedious clicking for you. The company just launched a research preview of Operator, its first general-purpose AI agent that can take control of a web browser and independently run web-based tasks.

It is initially available through operator.chatgpt.com exclusively for U.S. subscribers on the $200-a-month ChatGPT Pro tier. OpenAI plans to expand access to Plus, Team, and Enterprise users down the line. Sam Altman mentioned on a livestream that other countries are coming soon, though Europe will take a while.

Browsing the web like a human

When you fire up Operator, a mini-screen opens inside ChatGPT showing a dedicated browser window. You can watch the agent navigate, click buttons, scroll through menus, and fill out text fields in real time, accompanied by a running log of what it is doing.

At launch, Operator comes pre-configured for four main categories: online shopping, food delivery, dining reservations, and travel booking. OpenAI teamed up with platforms like DoorDash, eBay, Instacart, Priceline, StubHub, and Uber to make sure the agent complies with their terms of service.

Under the hood sits a Computer-Using Agent (CUA) model. It blends the multimodal vision of GPT-4o with the reasoning chops of OpenAI’s advanced models. Crucially, CUA does not rely on developer APIs. It simply looks at the frontend layout of a website and interacts with it just like a person sitting at a keyboard would.

Users can take over the browser window at any second, and completed workflows can be saved and shared with colleagues or friends.

The guardrails are bolted on tight

Letting an autonomous model loose on the open web is inherently terrifying. Security researchers have long warned about prompt injection, where malicious web text could hijack an agent mid-task. OpenAI co-founder Wojciech Zaremba recently pointed out that OpenAI delayed this launch specifically to avoid the blowback Anthropic faced over weaker safeguards.

Because of that, OpenAI is keeping Operator on a very short leash. The model is trained to pause and demand manual user confirmation before executing any action with permanent consequences, like finalizing a purchase or sending an email.

For banking tasks or entering payment credentials, Operator flatly refuses to take the wheel. It will also throw its hands up and ask for help if it runs into complex non-standard layouts, password fields, or CAPTCHA challenges. There are also dynamic task limits and a daily cap on how much you can use it.

Why it matters

AI progress has hit a plateau in pure text generation, pushing the entire industry toward agentic workflows where models do real work instead of just drafting summaries. Operator marks OpenAI’s official entry into the browser-agent arena, going head-to-head with Anthropic’s Computer Use and Google’s upcoming Project Jarvis.

Right now, a $200 monthly Pro subscription keeps this firmly in early-adopter territory. Having an AI spend three minutes finding a table on OpenTable is not quite a game-changer when you still have to supervise it through login screens and payment confirmations. If babysitting the agent takes longer than booking the table yourself, the productivity gain evaporates.

Still, OpenAI’s cautious rollout feels like the right play. A single rogue hallucination that charges thousands of dollars to someone’s credit card could set consumer trust back by years. By restricting Operator to front-end browsing and enforcing strict human checkpoints on money and credentials, OpenAI is proving that useful agents will arrive through careful, step-by-step automation rather than reckless autonomy.