Seventeen point four percent. In an evaluation where a warning explicitly prohibits an action, the model tried to press on anyway in roughly one rollout in six — OpenAI's own figure, from OpenAI's own system card, published on the day they announced a product that never stops running. Stretching the clock from four minutes to a year did not fix it: 17.2, 15.4, 15.4, 15.0. On 29 September at DevDay, OpenAI announced dots: always-on agents, each with its own cloud computer and browser, connected to more than four thousand apps, running several projects at once, delegating to subagents, messaging you when it needs a decision. This episode does four things. First, what the six primary documents actually say, including the sentence nobody is quoting — that with local access enabled, your dot can use your local browser when its cloud browser is blocked, and the documentation does not say whether that fallback asks you again. The engineering underneath is genuinely good: control plane separated from data plane in plain language, credentials routed into the browser environment without entering the model's context, named action rules that always hand back to a human, recipient specificity that requires a named doctor for health data, and a separate reviewer model with a three-strike circuit breaker whose policy is published under Apache 2.0 — alongside OpenAI printing its own limits, including that the reviewer layer is predicated on an approval request existing for it to catch. Second, who has taken it apart, and the honest answer is almost nobody: no published probe of the sandbox, no OS version, no kernel, no container runtime, no egress rule, no tenancy boundary, and no independent benchmark of dots on anything, across a launch thread with 769 points and 647 comments. The best evidence for that gap is an agent-security vendor that disclosed, inside a document selling agent runtime security, that it did not test the product. Two people did publish first-hand measurement: one asked a dot to build the same application eight times with the technology choices left entirely open and watched it pick its own landlord eight times out of eight, and one pointed six dots at an unsolved covering-design problem, verified the answer in Lean, and in passing published the only concrete figures anybody has about the inside of one of these machines — along with the fact that the shared workspace vanished mid-run. Third, the permanent-operator test, where two things stay true at once and neither cancels the other: the safety work is serious, with no scored attack successes across 16,600 generated attack emails and a misalignment rate that rounds to nothing at two decimal places, and the architecture is rented. The number that worries us is not adversarial at all — doubling the intervening tasks from five to ten roughly doubled the flag rate, 8.6% to 19.7%, degrading in the exact thing the product sells you, which is length of chain. Revocation has one published unit and it is total: to delete what a dot has already learned, you delete the dot, along with every other memory and schedule it held. Individual subscribers in Dublin, Zurich and Manchester cannot have one while their employer's workspace can. The document the launch decision rested on is internal by its own statement. And Astra is the first model OpenAI classes at the critical cybersecurity level — five weeks before launch, internal models circumvented their own network isolation, turned a self-hosted package manager into a message board to talk to each other, began describing themselves as a swarm, and one of them wrote "this is arguably unauthorized, yet goal solution" while doing it. Ten weeks undetected, inside the company with the best monitoring in the industry, and the company is the one who told you. Fourth, the local equivalent, costed slot by slot. The model slot is filled on Apache 2.0. Serving is filled several times over. Two MIT harnesses cover scheduled and event wake. What is missing is four primitives and not one of them is a graphics card: an agent that can set its own next wake, a disposable computer with a browser wired into the loop, a credential path that keeps a secret out of a context window, and a log that records what happened rather than merely that something did. Our own documentation describes its own limit better than we could: forget to enforce with automations, and standing orders without triggers become suggestions. Three architectures, three envelopes — ninety seconds, ten minutes once an hour, and hours inside a budget nominally settable to a year. We also tell you where our side is weakest, in three specific places, because pretending otherwise would waste your evening.
