A dozen people, 28 minutes, and one shared desktop

Hosts Sonya Huang and Lauren Reeder sit down with Isa Fulford, Casey Chu, and Edward Sun, the OpenAI group behind ChatGPT Agent. Fulford describes a collaboration between the former Deep Research and Operator teams that gives the model a virtual computer and a job that would take a person a long time. On that machine it has more than one way onto the internet.

A text browser, inherited from Deep Research, is fast at fetching and searching. A graphical browser, inherited from Operator, sees the actual page: click, type, scroll, drag, fill forms. A terminal runs code, analyzes files, and writes artifacts such as spreadsheets and slides. Through that terminal it can call public APIs or, after the user signs in, private ones — GitHub, Google Drive, SharePoint. There is even an image generator if the slides need a picture.

The load-bearing choice is that every tool shares state, the way applications on a laptop share a filesystem. Download in the browser, process in the terminal, open the result back in the browser. Fulford’s claim is that this is simply a more flexible way for a model to do complex work on a user’s behalf. Efficiency and flexibility stop being a tradeoff because the agent can switch without a human in the loop.

The origin story is a January double bill. Chu’s team shipped Operator, an agent that shops, books, and fills forms on the live web. Two weeks later Fulford’s team shipped Deep Research, a model that browses extensively and writes long cited reports. Operator was strong on visual page interaction and weak on long articles. Deep Research was the reverse: a text browser that could not scroll, click, or complete forms the way a GUI agent can. Users also begged Deep Research for paywalled sources — something Operator could already reach.

A teammate named Eric sealed the merge. He analyzed Operator prompts and found a pile of Deep Research-shaped requests: research this trip, then book it. Chu calls it a match made in heaven. Asked whether one plus one equals three, he says they did not stop at the two products. They threw in everything they could think of: a terminal for calculations, image generation to spruce up slides, APIs, even PowerPoint output. Fulford later admits the launch was framed internally as a “minimum shippable de-risk,” mostly for PR. This is the most basic version the two teams could make together. The ceiling, she says, is still ahead — slides, credited to Aiden, Paloma, Martin, and others, are a new skill they expect to push much further with the same methods.

They kept the name *agent* vague on purpose. Deep Research surprised them when people used it for code search; they want the next surprise. Edward Sun pulls data from spreadsheets and docs into presentation slides. Chu has been using it on ancient DNA, a field moving too fast for a textbook survey. Fulford shops for clothes, because filters and product photos need a visual browser, and plans events. They aim at the prosumer who will wait half an hour for a detailed report, at home or at work. Sonya asks if you can tell it to go make money on the internet. Chu says you can. Fulford adds: it will try.

Right before taping, a colleague asked the agent to estimate OpenAI’s valuation from public information, build a financial model with projections, write a summary, and present it as slides. Fulford jokes that she hopes the model is right, because the forecast was ambitious. The trajectory reasoned for about 28 minutes. Chu had just finished an hour-long run, longer than he had seen from a model working on its own. Edward Sun says they built tools so the model can extend context past the original hard limit by documenting what it has done, stretching the horizon without a human interruption.

Long jobs only work if the human can steer. Fulford says they modeled the product on asking someone for help on Slack. You give instructions; they ask a few questions; they start; halfway through they come back to clarify, or to ask you to sign in. You remember something you forgot, interrupt, ask for a status update, or yank them off a wrong path. Both sides have to be able to initiate. What shipped is the most basic version of that loop, and still, she says, better than anything OpenAI had released in the area.

The agent can ask clarifying questions, but it is not rigid about it — unlike Deep Research, it does not always interrogate you first. You can cut in: summarize what you have done, or “I forgot, I only want blue sneakers.” Before a destructive action or a login, it asks permission. Chu describes a computer interface that lets you watch the agent work. The virtual machine persists after the task, so you can return, ask follow-ups, fix something, or assign the next job. You can also take over: click for it, log in, type a credit card number. His metaphor is looking over a coworker’s shoulder and grabbing the keyboard when you need to. Sonya thanks them for enabling the micromanager in her.

The training recipe is the same family as o1: reinforcement learning. Edward Sun says they put every tool — text browser, GUI browser, terminal, image generator — into one virtual machine, wrote hard tasks, and rewarded the model for finishing them efficiently and correctly. After that training it switches fluently. Ask it to research restaurants and book a table, and it will do Deep Research-style text browsing, then open the GUI browser to see food photos and availability that live in JavaScript a text scraper cannot render. Ask for an artifact, and it pulls sources from the web and finishes them in the terminal.

Shared state is what makes this different from older tool-use stacks. Fulford repeats the laptop analogy: download a file in the efficient text browser, notice you need pixels, switch to the visual browser, or hand the file to the terminal and open the result back in a browser. Chu’s line is the one that stuck. They give the model all the tools, lock it in a room, and let it experiment. They do not tell it when to use which tool. It figures that out. “It’s kind of almost magic.”

Sonya asks whether this is now the standard way OpenAI trains agents. Fulford thinks they can take it much further. The two teams had not collaborated long. Internally they called the run a minimum shippable de-risk. Slides already look impressive and still have room. Edward Sun says the same RL algorithm has felt magical from o1 reasoning through Deep Research tool-calling to this more advanced computer-use agent. The limit, Fulford immediately adds, is no longer only capability. This model can take actions with external side effects.

Deep Research was read-only, which capped the blast radius. ChatGPT Agent can change the outside world. Fulford’s example is a shopping ask that the model “succeeds” by buying a hundred different options to make sure you are satisfied. Sonya puts the nightmare version: how do you stop it from logging into a bank account and sending everything to a Nigerian prince? Chu’s first answer is that the internet itself is a scary place — attackers, scammers, phishing — and the model has to touch that world on purpose.

Safety training helps it reason about shady pages if you tell it to be careful, but it can still be fooled, and it can be overeager to finish. They stacked mitigations. One Chu calls out is a monitor that looks over the agent’s shoulder, like antivirus: if the trajectory hits a weird website, stop. They cannot catch everything. They do have a rapid-response path so new attacks in the wild can update the monitors the way virus definitions update. Fulford stresses it was a cross-org push — safety, governance, legal, research, engineering — with external and internal red teams, and a plan for the new failures that will show up after launch.

Biological risk sat near the top of the list. A more powerful research agent can speed up work and, they worry, speed up harm, including bioweapons. The team ran many weeks of red teaming to make sure the model could not be used for those harms, plus other mitigations. Chu shouts out Karen for spearheading that effort. The posture he describes is caution, not a claim that the problem is solved. Contact with the real web is also an engineering mess: thousands of VMs, sites down, capacity limits, load tests. That, he says, is a major limitation they are still ironing out.

Two research groups and two applied groups — Deep Research and the computer-using / Operator side — merged and now sit on top of each other. Fulford says Deep Research was three or four people for most of its life. Chu puts the computer-use research side at around six to eight. An applied team of engineering, product, and design, led by Yash Kumar, sits with them. Research and applied define the product together, working backward from real use cases into training. The hosts are surprised by the size. The guests note they had only been a combined team for a few months. Edward Sun adds that the research/applied line is porous: applied engineers help train, and researchers help deploy.

The hardest part of training, Sun says, was stability. Deep Research already had mature browsing and Python. The new agent bundles a computer and a terminal in the same container, then spins up hundreds of thousands of virtual machines that all hit the live internet. Training sometimes failed. They were happy simply to get a model trained. Chu had already flagged the smaller version of the same pain: even running the environment at thousands of VMs means broken sites and capacity walls. The romance is RL. The bill is distributed systems.

What is next is not a new limb so much as accuracy across the whole distribution of computer work. You can already ask it to do anything you can imagine, Fulford says; it just might not do it well. Through iterative deployment they want users to discover capabilities the way people found coding inside Deep Research and research inside Operator. Sun uses Agent mode for code because it makes small edits instead of rewriting a codebase and reads original function docs, so it hallucinates less on calls. He sends well-specified problems to Codex for a pull request, and uses Agent more like o3: interactive, a function or a suggestion, plus GitHub search through the API connector.

Fulford wants two product shifts: better multi-turn work, which Deep Research never quite delivered when people stacked requests in one thread, and personalization plus memory. Today every agent task starts with the user. Later it should do things without being asked. Chu is more excited about the UI leaving the ChatGPT conversation box. Sonya asks whether the endgame is one omniscient agent or a zoo of specialist sub-agents. Fulford’s limit case is a chief of staff who routes correctly. Chu has watched shopping trajectories drop into the terminal to run a budget; the model should be free to use every tool without first becoming a “financial analyst.” Sun’s training argument is positive transfer: deep research, computer use, and slide generation help each other, so one base agent is the rational thing to train. Custom GPTs can still put a shipped model into a role.

On RL, they built a diverse task set: niche web answers, full-length Deep Research articles, and whatever else they wanted the model to be good at. Edward Sun’s rule is blunt. If you can grade the result — if you can tell whether the model did well — you can reliably train it to be better. Most of that work optimized end-to-end completion from a specified prompt, and turn-by-turn collaboration showed up anyway. Fulford’s overlooked point is data efficiency. RL data is minuscule next to pretraining. A small, high-quality curated set can teach new capabilities. Chu adds a precondition: before RL, the model had to be good enough to complete basic computer-use tasks. Getting it to reason about a page and understand visual elements took their team two, maybe three years.

Sonya remembers World of Bits, the 2017 OpenAI attempt to RL mouse paths, which felt too unbounded to solve. Chu grins: the computer-use code name is World of Bits 2. What changed is scale — on the order of 100,000 times more compute and training data, pretraining plus RL. “Scale catching up to our ambition,” plus some good data. The capability he is proudest of is unglamorous accuracy: forms that actually fill. Date picking in a calendar dropdown still needs work. Fulford says it is the hardest task for some reason. Sonya notes it is hard for humans too. On the science side, Sun says the model is already strong at real data-science work, summarizing findings into spreadsheets. An internal data science bench beats the human baseline; in some samples it is superhuman at basic analysis. He shouts out John Blackman for pushing spreadsheets and data science.

Ahead, Fulford comes back to the generality of the tool. It covers most of what a person can do on a computer. The remaining job is to make the model good at all of those tasks, with training as diverse as the tool is general, and to invent new ways of interacting with a virtual assistant. That is a lot of hard work. They sound glad to have it.