What's the specific step where Dots differs from a typical ChatGPT agent mode?
A typical agent mode remains a synchronous loop — user initiates, agent executes, reports back, waits for the next instruction. Even with multi-step planning in between, the user remains both the starting and ending point of the loop. Dots is designed to keep running in the background after launch, officially described as needing "minimal supervision" — meaning it doesn't wait for your next instruction to continue; it keeps pushing toward the goal on its own until it completes the task or hits a point requiring approval.
The difference sounds subtle, but it determines who notices a problem first. When an interactive agent goes wrong, you typically catch it in the next round of conversation. When an always-on agent goes wrong, you might have to wait for it to report back on its own, or for some external signal to alert you.
Why does Dots specifically integrate Microsoft Agent 365's security controls — isn't building its own governance enough?
Relying solely on the model's own judgment to prevent an agent from doing something wrong has a fundamental limitation: a model can always misjudge under some combination of circumstances, and this isn't a risk that training alone can fully eliminate. In enterprise settings, an agent that runs continuously in the background, connects to communication tools, and has multi-step autonomy can cause damage far beyond an interactive agent's blast radius if it misjudges and nothing external catches it.
The identity governance, access-scope controls, and audit logging that Microsoft Agent 365 provides are mechanisms already validated at the traditional IT governance layer. Dots choosing to integrate rather than reinvent this suggests OpenAI itself has concluded that risk control for always-on agents can't rely on the model layer alone.
If I want to build my own always-on agent, how should the 'termination conditions' mentioned in the article actually be designed?
The key is not just defining "what to do on success," but equally clearly defining "the signal that means it should stop on failure." A common trap is giving the agent only a goal (e.g., "continuously monitor customer reports and fix bugs") without defining what circumstances mean that goal itself is now stale or was misunderstood — the result is an agent that keeps grinding away indefinitely in the wrong direction in the background, because from its own vantage point, the task simply isn't done yet.
In practice, termination conditions should cover at least three categories: clear completion criteria (quantifiable and verifiable), a timeout mechanism (pause and report rather than keep running once it exceeds expected duration), and re-confirmation triggered by environmental change (if a precondition the goal depended on has shifted, it should stop and let a human re-confirm rather than proceeding on the original plan).
My team currently uses interactive agents — when should we seriously start considering these three braking mechanisms?
You don't need to wait until you adopt an always-on agent product like Dots. The moment your agent starts gaining the ability to execute multiple steps continuously without requiring step-by-step human approval, you've already entered the zone where this matters — even if it still superficially appears to only start when you issue an instruction, once it can autonomously run through a dozen steps and call multiple tools before reporting back, the point of human intervention has already been pushed back.
A practical rule of thumb: if a single agent execution runs long enough that you can't watch it the whole time, or if it calls write-capable tools (sending emails, placing orders, modifying files) without you knowing in real time, these three mechanisms are already necessary — not something to add only once it becomes a 24-hour always-on system.
At OpenAI's DevDay on September 29, 2026, the company unveiled a new product called "Dots" — a personal agent powered by GPT-6 Astra, officially described as "always-on." Unlike the previous interaction model where you type a request and the agent responds once, Dots is designed to keep running in the background after launch, working toward a user-defined goal until it either completes the task or hits a point requiring human approval — all without you needing to watch the conversation window. This sounds like a natural upgrade in agent capability, but for developers, the shift involves more than "the model got stronger" — it changes how responsibility is distributed across the entire system.
The traditional agent workflow is, at its core, a synchronous loop: the user issues an instruction, the agent executes and reports back, then waits for the next instruction. Even agents capable of multi-step planning still treat the user as both the starting and ending point of the loop — if something goes wrong, it typically surfaces in the next round of interaction. Dots breaks precisely this assumption. OpenAI describes it as able to "continuously work toward a user-defined goal in the background with minimal supervision," with example use cases including a software developer deploying a dedicated dot to continuously monitor customer reports and fix bugs, or a scientist having a dot re-run analyses and investigate anomalies in experimental data. What these scenarios share: the agent keeps making decisions, calling tools, and changing things while you aren't watching.
This forms an interesting parallel with Meta's Muse, launched almost simultaneously — both adopt anthropomorphic visual designs (Dots' cartoon avatar, Muse's virtual persona) in an attempt to make "an AI that does things on its own" feel approachable. But the underlying engineering problem both are really trying to solve is the same: once an agent is no longer a tool that only moves when you call it, who ensures it doesn't drift too far off course during the stretch of time nobody is supervising it?
One notable technical signal: Dots chose to integrate with Microsoft Agent 365's security controls, and supports organizational communication platforms like Slack and Teams. This choice itself reveals OpenAI's assessment of the risk inherent in "always-on agents" — in enterprise settings, an agent that runs continuously in the background, connects to communication tools, and has multi-step autonomy can't rely solely on the model's own judgment. It needs external identity governance, access-scope controls, and audit logging — the traditional tools of IT governance — to fill the gap. This aligns with a broader trend across agent security: rather than hoping the model always makes the right call, the strategy is to architecturally contain the blast radius of an unavoidable risk — that the agent will, at some point, get it wrong.
If you're planning to introduce always-on agents into your own systems — whether through Dots' API or a self-built equivalent architecture — there are three design elements that could be safely ignored in the interactive-agent era but become mandatory under an always-on model:
First, clear termination conditions. An interactive agent's termination condition is simple: the task ends when the user stops sending new instructions. An always-on agent must have "what counts as done" and "what counts as a failure that should trigger a stop" defined at launch — otherwise it will keep trying indefinitely to achieve a goal that may already be stale or misunderstood.
Second, an interrupt mechanism that can step in at any time, not a post-hoc fix. When an agent runs in the background, the moment a human notices a problem is inherently delayed — you aren't watching it execute step by step; you're waiting for it to report back, or waiting for some external signal to alert you that something went wrong. This means the system design must include an interrupt point that can halt the agent immediately without needing to first understand what it's currently "thinking" — not one that only allows intervention after it finishes a full cycle of logic.
Third, change traceability needs to be far more complete than for interactive agents. When no human is present to witness every decision, reconstructing after the fact "what the agent actually did and why" becomes critical — which is likely why Dots opted to integrate enterprise-grade security controls and audit capabilities rather than relying on a chat log window alone. For developers, this means an always-on agent's logging granularity can't stop at "what went in, what came out" — it needs to capture which tools it called along the way, what permissions it obtained, and what judgment it made at each decision point.
If your team is planning to adopt or build an always-on agent architecture, the budget that actually needs allocating isn't feature development to "make the agent do more" — it's the three braking mechanisms above. These rarely make it into the initial product demo, yet they're the deciding factor in whether an always-on agent's first mistake after launch is "a small, traceable, stoppable problem" or "an unnoticed issue that keeps compounding." Before evaluating how much an always-on agent product or framework can do, ask first how well it handles termination conditions, interrupt mechanisms, and audit logging.