Skip to content
redactsure
Book a demo

Explore.

Data Report · By Chris Sowa · Published
Last updated

Is It Safe to Let ChatGPT Work Access Sensitive Company Data?

Only with two things OpenAI's documentation points to: administrator scoping of what the agent can reach, and a record kept outside the product, since OpenAI says its compliance logs retain 30 days and are not a complete audit trail. Check which connectors and sites are allowed, who approved them, and where the record of what the agent read lives.

Company documents and storage objects connect through a field boundary and an abstract ring toward a record stack.

Only with two things OpenAI's documentation points to: administrator scoping of what the agent can reach, and a record kept outside the product, since OpenAI says its compliance logs retain 30 days and are not a complete audit trail. Check which connectors and sites are allowed, who approved them, and where the record of what the agent read lives. OpenAI has retired ChatGPT agent in favor of ChatGPT Work, and its help page for the retired product still carries the sentence that frames this question: with connected apps, the agent can access sensitive data like emails, files or account settings. That is the capability an enterprise buys and the exposure it accepts. OpenAI's documentation for ChatGPT Work describes administrator controls over sign-in and site allowance, and its administrator FAQ is candid about the limits of the compliance logging that comes with it. The question is whether those controls, plus that record, add up to a basis for letting the agent reach regulated or confidential records. This page sets out what ChatGPT Work is and what happened to its predecessor, what OpenAI says the agent can reach, which controls its documentation describes, what the compliance log covers and does not, what would make access to sensitive data safe, and the claims a buyer should refuse. It builds on how much enterprise data an agent can actually reach.

Key findings

  • OpenAI's help page for ChatGPT agent notes that the product has been retired in favor of ChatGPT Work, and states that with connected apps the agent can access sensitive data like emails, files or account settings (OpenAI, 2026).
  • OpenAI's ChatGPT Work overview states that website sign-in through the cloud browser is not available in Enterprise or Edu workspaces, and that allowing a website does not approve every action on that site (OpenAI, 2026).
  • OpenAI's administrator FAQ states that the Compliance Logs Platform retains data for 30 days and that its records do not establish a complete audit trail for every browser interaction, tool call or approval (OpenAI, 2026).
  • The same help page states that screenshots are not captured during takeover, which helps protect passwords, a control on what the model sees during the moments a person types (OpenAI, 2026).
  • OWASP describes sensitive information disclosure, confidential data entering a model's context through its inputs, as a top-ten risk for LLM applications, and a connector to email and files is such an input (OWASP, 2025).
  • An audit of sensitive data access across enterprise applications needs a record of what was read, not only what was done, which is the gap a 30-day partial log leaves (How to audit sensitive data access across enterprise applications?).

What is ChatGPT Work, and what happened to ChatGPT agent?

OpenAI's help center page for ChatGPT agent notes that the product has been retired in favor of ChatGPT Work (OpenAI, 2026). Press reporting fills in the sequence: PPC Land reported in July 2026 that OpenAI discontinued its Atlas browser and folded it into the new ChatGPT Work agent (PPC Land, 2026), and The Next Web reported in September 2026 the launch of dots, always-on agents with their own cloud computers (The Next Web, 2026). OpenAI published its own account of how it builds safety, security and privacy into dots (OpenAI, 2026). The lineage runs from Operator, whose system card dates from January 2025 (OpenAI, 2025), through ChatGPT agent to ChatGPT Work and dots.

The lineage matters in two ways. The capability has been consistent across names: an agent that operates a browser in OpenAI's cloud and, through connectors, reaches the organization's applications and data. And the documentation is spread across products, so the sentence about accessing sensitive data sits on a page for a retired product while the administrator controls sit on pages for the current one. This page reads them together as the record of one capability under successive names, treating the retired page's statements as current where OpenAI has left them standing.

What does OpenAI say the agent can reach?

The retired product's help page is the plainest statement: with connected apps, the agent can access sensitive data like emails, files or account settings (OpenAI, 2026). Connectors are the mechanism: the agent is connected to a mail system, a document store or a business application and reads through that connection as the connected account would. The cloud browser is the second path, operating web applications in a browser of its own in OpenAI's cloud.

Take a single record type: a customer account record in a web-based CRM, with the customer's name, email, phone, billing address, contract value and support history. An employee asks ChatGPT Work to prepare a renewal summary. Through a connector to the mail system, the agent reads the correspondence with that customer. Through the cloud browser, if the site is allowed and signed in, it reads the account record as the CRM renders it. The summary is produced. Every value on the record and in the correspondence has entered the model's context, on OpenAI's infrastructure, for the duration of the task, and the organization's knowledge of exactly which values is whatever the product's log retained.

OWASP's sensitive information disclosure entry describes the exposure: confidential and personal data entering a model's context through its inputs, where it can be reproduced, reused or extracted (OWASP, 2025). A connector to email and a browser on the CRM are two such inputs. Whether the data should be transformed before it reaches the model, rather than governed by contract after it has, is the argument of protecting sensitive data before it reaches ChatGPT, Claude or Gemini; the point here is that OpenAI's own documentation says the data reaches the model.

Which controls does OpenAI's documentation describe?

OpenAI's ChatGPT Work overview describes two administrator-level controls. Website sign-in through the cloud browser is not available in Enterprise or Edu workspaces, and allowing a website does not approve every action on that site (OpenAI, 2026). The first removes a path by which an employee could point the agent at any application with a login; the second separates site allowance from action approval. The retired product's page adds a third control: screenshots are not captured during takeover, which helps protect passwords (OpenAI, 2026). OpenAI's Agents SDK documents a human-in-the-loop pattern for developers building their own agents (OpenAI, 2025).

Dimension ChatGPT Work, per its documentation What a buyer should verify
What the agent can reach With connected apps, sensitive data like emails, files or account settings Which connectors are enabled, by whom, with what scope
Cloud browser sign-in Not available in Enterprise or Edu workspaces How allowed sites are reached and authenticated for the agent
Site allowance and actions Allowing a website does not approve every action on that site Which actions require approval, and who answers
Masking of values on a connected record Not described in the pages reviewed Whether any control changes what the model reads from a connector or page
Record of activity Retains 30 days; not a complete audit trail Where the complete record lives, and for how long

Each documented control governs reach or action. None, as described in the pages reviewed, changes the content of a connected mailbox or an allowed page before the model reads it, and a buyer should carry the distinction between controlling reach and controlling what is read into every conversation about the product.

What does the compliance log cover, and what does it not?

OpenAI's administrator FAQ is specific. The Compliance Logs Platform retains data for 30 days, and its records do not establish a complete audit trail for every browser interaction, tool call or approval (OpenAI, 2026). Both limits are stated by the vendor. A 30-day retention means an incident discovered in the second month has no product log to consult. An incomplete trail means that even within the window, the organization cannot reconstruct every page the agent read, every connector call or every approval.

For a regulated record the gap is concrete. If the customer in the example above later exercises a data access right, or a regulator asks what systems processed the record, the organization needs to know whether the agent read it, when, through which path, and what it did with the values. The product's log, as OpenAI describes it, may answer some of that for 30 days and does not promise to answer all of it. The organization's own retention obligations are typically measured in years. The page on auditing sensitive data access across enterprise applications sets out what a usable record contains: what was read, not only what was done, under which identity, with which approval.

This is why the title question has a two-part answer. Administrator scoping decides what the agent may reach, and OpenAI documents real controls for that. An independent record decides whether the organization can later show what the agent did reach, and OpenAI's documentation says the product's own record is partial and short. The second part has to come from somewhere else, and it has to capture the screens and the connector reads, not just the actions, because for sensitive data the reading is the event.

What would make access to sensitive data safe?

Three conditions, each testable. First, scoping by an administrator rather than an employee: connectors enabled deliberately with the narrowest account access the task needs, allowed sites listed and reviewed, and the actions that require approval defined. OpenAI's documentation supports each as an administered choice in enterprise tiers. Second, a record outside the product that captures what the agent read as well as what it did, retained for as long as the organization's obligations require, and exported to the organization's SIEM so the agent's activity sits beside everything else. Third, a decision about what the model should see on a sensitive record at all, since none of the documented controls changes the content of a connected mailbox or an allowed page.

The third condition is where the posture tools and the access tools reach their limit. A data security platform can report which records are sensitive and who can reach them, and the comparison with a data access governance platform for AI access to sensitive data sets out what that layer covers. It does not change what a model reads once a connector hands it the mailbox. Securing AI agents that access customer data treats the general design: the record arrives at the model with the customer as CUST_001, the email as EMAIL_001 and the contract value as a token, the same token for the same value through the run, and real values resolve only at the approved destination when a named person approves the action.

Under those conditions an organization knows what the agent may reach because an administrator set it, what it did reach because its own record says so, and what the model saw because the record holds the screens as the model received them. Without the second and third, it is relying on a 30-day partial log and the vendor's assurance.

What does a governed environment change?

In a governed environment, ChatGPT Work's reach into sensitive company data changes shape, because the model reads tokens where the mailbox and the CRM showed real values, and the record of what it read belongs to the organization rather than to a 30-day vendor log.

The mechanism is a class of control that sits between the rendered screen and the model. Sensitive values on the page, including the addresses, account numbers and attachment contents a connector exposes in full, are replaced with consistent tokens before any model reads them, so the task runs on tokens. Real values resolve only at an approved destination at the moment of an approved action. A named person confirms what is tokenized and approves consequential actions, including payments, submissions and record changes. Every screen as the model received it, in token form, every action and every approval is recorded and exported to the organization's own logging.

This bears on the page's question at the two points the buyer's list marked. OpenAI states that the Compliance Logs Platform retains data for 30 days and does not establish a complete audit trail for every browser interaction, tool call or approval (OpenAI, 2026); the environment's record is durable, held by the organization and covers reads as well as actions. And where the takeover control covers only the moments a person types, the tokenized screen covers every moment the model looks, which closes the input OWASP names under sensitive information disclosure (OWASP, 2025).

The control does not change ChatGPT Work's connectors, the administrator's site allowlist or the model; it changes which values are on the screen when the model reads it and where the record of that reading lives.

Where does RedactSure sit?

The environment that enforces this is built by RedactSure, an AI agent controls, governance and data protection company. The design supplies the second and third conditions above: the agent works in a governed environment in the customer's cloud, and values are substituted at the render layer before any model reads the screen, so the customer account arrives as CUST_001 with EMAIL_001, PHONE_001 and a token for the contract value, with the same token for the same value across the whole run. Real values resolve only at approved destinations at the moment of an approved action, such as the CRM receiving the renewal update. A named person confirms the tokenization policy and approves every payment, submission and record change under Supervised Delegation. Every screen as tokens, every action and every approval lands in the AI Control Record and exports to the customer's SIEM, retained under the customer's own schedule rather than a vendor's 30 days. The design is model agnostic, so the model operating the task can be OpenAI's, requires no per-application integration, and leaves user permissions unchanged.

Deployments are in pilot. A pilot on one renewal or support task would show the record as the model received it, the named approval on the action, and the entry in the organization's own SIEM. Everyone else controls where data can go. RedactSure controls what the AI can see.

Methodology and limitations

This page rests on OpenAI's own documentation: the help center page for the retired ChatGPT agent, the ChatGPT Work overview, the ChatGPT Work administrator FAQ, the Operator system card, the account of safety in dots and the Agents SDK human-in-the-loop guide; on press reporting by The Next Web and PPC Land on the product sequence; on the OWASP Top 10 for LLM Applications entry on sensitive information disclosure; and on RedactSure research pages on data access, auditing, customer data and protection before the model. All sources were read as of October 16, 2026.

No hands-on testing of ChatGPT Work or any other named product was performed, and no connector was enabled or record accessed for this page. Facts about OpenAI's products come from OpenAI's own pages where cited; statements on the retired product's page are treated as current where OpenAI has left them standing, and the retirement is stated as the page states it. Where this page says a control is not described, it means not described in the pages reviewed, not that the product lacks it. Vendor documentation is read as a statement of design intent rather than as test evidence. OpenAI's agent products have changed names several times, and the page carries its date for that reason. Statements about RedactSure describe its current design, with deployments in pilot. The CRM customer account described here is a record type, not any organization's system, and no customer or prospect is described.

Whether letting an agent reach regulated or confidential records through connectors and a cloud browser is permitted under an organization's policies, contracts and regulatory obligations is a determination for its counsel, its assessors and its own security and compliance officers, not for a research page.

What the record shows

OpenAI's documentation answers the title question directly. The agent, under its current name, can access sensitive data like emails, files or account settings through connected apps; administrators in enterprise tiers can withhold cloud browser sign-in and separate site allowance from action approval; and the compliance log that comes with the product retains 30 days and is not a complete audit trail. Those three statements, read together, say that reach is real, scoping is available, and the record is partial. Letting the agent reach sensitive company data is therefore safe to the extent the organization supplies what the product does not: a record of what was read as well as done, kept on its own schedule, and a decision about what the model should see on a sensitive record at all, which is the layer RedactSure's design occupies. The test is to name one connector and one record and ask where, in sixty days, the organization will be able to see what the agent read from it.

Frequently asked questions

Is ChatGPT agent the same product as ChatGPT Work?

OpenAI's help center page for ChatGPT agent notes that the product has been retired in favor of ChatGPT Work. Press reporting describes the Atlas browser being folded into ChatGPT Work and the later launch of dots, agents with their own cloud computers. The capability has been consistent across the names: a browser in OpenAI's cloud plus connectors to the organization's applications. This page reads the documentation across the products as the record of one capability, and states the retirement as OpenAI's page states it.

What does OpenAI say the agent can access?

The help page states that with connected apps the agent can access sensitive data like emails, files or account settings. Connectors are the mechanism, and the connected account's scope is the agent's scope through that path. The cloud browser is the second path, reading what allowed web applications render. Neither path, in the pages reviewed, is described as changing the content of a record before the model reads it.

Does the compliance log satisfy our audit requirements?

OpenAI's administrator FAQ states that the Compliance Logs Platform retains data for 30 days and that its records do not establish a complete audit trail for every browser interaction, tool call or approval. Whether that meets an organization's requirements is for its compliance officers, but the vendor has described the log as partial and short. Most regulated organizations retain access records for years and need to show what was read, not only what was done, which is a different record from the one OpenAI describes.

Does the takeover control protect sensitive data?

It protects what a person types during takeover. OpenAI states that screenshots are not captured during takeover, which helps protect passwords. It does not change what the model read from a connector or an allowed page before the takeover, or what it reads afterward. A mailbox reached through a connector is read in full regardless of what happens during the moments a person is typing a credential.

What does it mean that allowing a website does not approve every action?

It means site allowance and action approval are separate decisions, per OpenAI's ChatGPT Work overview. An administrator may allow the CRM without thereby approving the agent to submit a change there. A buyer should ask which actions require approval on an allowed site and who answers, since an allowed site with no action controls is a site the agent can read and act on freely.

What should we put in place before enabling connectors to sensitive systems?

An administrator-held list of enabled connectors and allowed sites with the scope of each connected account; a defined list of actions that require approval and a named person who answers; a record outside the product that captures what the agent read and did, exported to the organization's SIEM and retained on the organization's schedule; and a decision about which values on a sensitive record the model should see at all.

Book an AI Agent Security Review →

Bring your hardest questions.

Bring one sensitive workflow and the decisions your team needs to keep in its hands.

Book a demo

About the author

Christopher Sowa
Chris SowaCo-Founder, President and Chief Commercial Officer, RedactSure

Chris Sowa is a founder of RedactSure and a former CEO of an AI company; he started it years before ChatGPT existed. He previously led AI at Accenture, served as Global VP of Strategy & Innovation at Schneider Electric, was CCO of Sovos, and spent more than a decade at Oracle, with earlier roles at SAP and IBM.

Book a demo

Book a demo

Having trouble? Open the booking page or email us.