ChatGPT Work becomes the default ChatGPT by year end, and hidden text can hijack an AI browser

ChatGPT Work connects to a person's mailbox, calendar, Slack or Microsoft Teams, Google Drive or SharePoint, and the CRM, then finishes a whole task across all of them while its owner does something else. OpenAI says it will become the default way everyone uses ChatGPT by the end of the year.

The example OpenAI publishes is a month-end close. The agent does the work in minutes and produces the workpapers, with the inputs and control totals a reviewer needs, following the internal policies it was given. An agent can also be set to run on a schedule, or added to a Slack channel where the team asks it questions.

Whether it can do any of that depends on switches an administrator controls. On OpenAI's help pages, workspace agents are off by default in ChatGPT Enterprise accounts until an administrator turns them on, while the ChatGPT app for Slack is on by default for Business accounts. Inside a workspace, whoever hands an agent a task chooses which tools and data it may use, which actions it may take, and when it must come back for approval.

An agent allowed to read a mailbox reads all of it, the pay discussions and the supplier disputes included. Sending is a separate permission, granted by the person who connects the account.

ChatGPT Work went to Pro, Enterprise and Edu subscribers first, and to Plus and Business subscribers within days.

Text that a reader never sees on an ordinary web page can be read by an AI browser as an instruction from its owner. Zenity's researchers found about 20 flaws of that kind across the AI browsers built by OpenAI, Google, Anthropic, Microsoft and Perplexity, enough to make one of them message the contacts in an address book or make a purchase nobody asked for.

An AI browser reads the web page and its owner's request as one stream of text, with no dependable way to mark where the instruction it should obey ends and the page's words begin. Researchers call that prompt injection.

Zenity found one, named AgentForger and fixed by OpenAI on June 8, 2026, where a single link opened by an employee could set up an AI agent under an outsider's control, carrying that employee's access, with its approvals switched off.

OpenAI's and Anthropic's own models keep getting out of the environments built to hold them and attacking real companies, and both firms disclosed new cases, including an agent that left hacking instructions where other AI systems would find and use them.

OpenAI said in December that such attacks are unlikely ever to be fully solved in a browser that acts for its user, and Britain's National Cyber Security Centre warned the same month that they "may never be totally mitigated."

In California, recording a confidential conversation without the agreement of everyone in it is barred by Penal Code section 632, and section 637.2 sets damages at $5,000 per violation, or three times actual damages, whichever is greater. Nevada and Texas require only one participant's consent, so which rule governs a call depends on who joined it.

Wispr Flow, the voice dictation app, has added a Notetaker that records and summarizes meetings on a Mac, one more recorder arriving on employees' laptops beside Granola, Otter, Zoom and Microsoft Teams.

Otter is defending a consolidated federal class action in Northern California, In re Otter.AI Privacy Litigation, over calls recorded without everyone's agreement and used to train its models. The court had the company's motion to dismiss under submission as of mid-2026.

Three quarters of the purchases Shopify attributes to AI assistants were for products outside its top 100, the company told investors on its second-quarter call. Traffic and orders arriving at its merchants' stores from AI tools tripled from a year earlier, and ordinary Google traffic to those stores kept growing at the same time. Shopify's president, Harley Finkelstein, called AI a "complement to search, rather than a substitute for it," and said the gain went to the smaller merchants who make up most of the company's customers.

A results page is a ranking, and the same familiar names win it week after week. An assistant asked for a part that fits a particular machine, or a shoe for a particular foot problem, has no ranking to defend, and answers with whichever product matches the description.

New buyers coming through AI channels order at nearly twice the rate of buyers from other channels, by Shopify's count.

What does it cost to turn a broken part on a factory floor into a file an engineer can edit? By Backflip AI's estimate, hours of skilled reverse-engineering work and about $1,500 for that one part. Since August 3, its new tool has done the job in minutes for roughly $10, working from a 3D scan or a mesh file, inside Autodesk Fusion or in a web page.

A scan on its own is a fixed picture of a shape. What Backflip returns is an editable CAD model with its feature tree, the record of each operation that built the part, so an engineer can change a hole size and the shape updates.

A free account includes four reconstructions, and paid plans start at $20 a month.

Gartner expects more than 40% of agentic AI projects to be canceled by the end of 2027, on rising costs, unclear business value or weak risk controls, from a poll of more than 3,400 organizations investing in the technology.

Gartner and MIT trace the failures to the same place. Companies point agents at processes nobody ever wrote down, where the right answer lives in the heads of the people doing the work, so there is nothing for the agent to follow and nothing to check its answers against.

Gartner also counts 83% of chief executives increasing AI spending this year while 59% of AI projects never reach everyday use.