Willison argues the underlying model hasn't fundamentally changed — what's new is the blast radius. By granting the agent connectors to email, calendar, files, code, and a headless browser, OpenAI has shipped exactly the product he's been warning about for three years: an LLM that reads untrusted content AND takes authenticated actions, with no reliable defense against prompt injection.
By submitting Willison's teardown to HN where it reached 290 points and 157 comments, gmays amplified the framing that ChatGPT Work's connector sprawl is the story — not any capability leap. The community engagement signals broad agreement that the security posture of agentic workplace tools deserves scrutiny.
Willison highlights that when ChatGPT Work 'reads a webpage' it renders the page in a real browser, executes JavaScript, and feeds the DOM back to a model that then takes actions. This is categorically different from retrieval-augmented chat and represents a threat model most enterprise procurement teams aren't equipped to evaluate.
Working through each connector's documented scope, Willison flags gaps between what the product page implies and what permissions the agent actually requests. This matters because users and admins are approving broader access than the marketing suggests, compounding the prompt-injection risk with quiet over-permissioning.
Simon Willison published a long-form annotation of ChatGPT Work — OpenAI's push to turn the chatbot into an autonomous workplace agent — and it's the kind of post that becomes the reference link people paste into Slack for the next six months. Willison's beat, for years, has been the unglamorous middle layer of LLM products: what the tool can *actually* reach, what happens when a user pastes something adversarial, and where the abstractions leak. His ChatGPT Work write-up is squarely in that lane.
The headline finding is that ChatGPT Work is less a new model and more a new blast radius. The underlying reasoning engine is broadly the same one you've been using; what changed is the set of connectors it can invoke without asking, the persistence of memory across sessions, and the fact that a single conversation can now span your inbox, your calendar, your files, your codebase, and a headless browser it drives on your behalf. Willison walks through each connector's documented scope, and — characteristically — points out where the marketing copy and the actual OAuth scope don't quite line up.
He also spends real time on the browser-use piece, which is the part most enterprise buyers underestimate. When the agent "reads a webpage," it's not summarizing a URL — it's rendering a page in a real browser, executing JavaScript, and feeding the DOM back into a model that will then take actions. That's a very different threat model from a chatbot with retrieval.
Willison has been the loudest sober voice on prompt injection since 2022, and ChatGPT Work is the product he's been warning about in the abstract for three years. The core problem hasn't moved: there is still no known reliable defense against prompt injection in an LLM that reads untrusted content and takes authenticated actions. Every mitigation is statistical. Every guardrail is a speed bump. Willison's phrasing — that the industry has quietly agreed to ship agents anyway and hope the blast radius stays small — lands harder now that the blast radius is your Google Workspace.
The concrete failure mode he sketches is worth memorizing: a colleague shares a Google Doc, the doc contains hidden instructions in white-on-white text, your agent reads it while summarizing your morning, and now it's forwarding your inbox to an attacker. You don't need a novel exploit. You need one careless share and one agent with mail-send scope. Willison's contribution isn't proving this works — he's shown variants of it a dozen times — it's mapping which of ChatGPT Work's default scopes make it trivial versus merely possible.
The second thing his post does well is push back on the framing that this is an "enterprise" product in any meaningful sense. Enterprise, historically, has meant SSO, audit logs you can actually query, per-scope admin controls, and a way to disable specific tools for specific groups. Willison notes what's there and what's still missing. The gap between "we shipped SCIM" and "an admin can see which files the agent read yesterday" is where most of the risk lives.
Third — and this is the part that hasn't gotten enough attention — he flags the cross-connector reasoning pattern. An agent that reads your calendar to find a meeting, then reads the meeting's linked doc, then drafts a reply in your voice, then sends it, is doing something no single tool in your stack was designed to be audited for. Your DLP rules were written for humans copy-pasting into browsers. They don't fire when a model does it on your behalf at 3am.
Community reaction on Hacker News tracked Willison's tone: less "this is dangerous, don't ship it" and more "this is inevitable, and the defaults are wrong." The most-upvoted comment thread argued that the correct enterprise posture is to treat ChatGPT Work like you'd treat a new contractor with root — least privilege, audit everything, assume compromise — rather than like a feature flag. That is not the posture OpenAI's docs suggest.
If you're the person your org will ask about this next week, three specific moves are worth making before the pilot request lands in your queue.
First, inventory the OAuth scopes before you enable connectors, not after. Willison's post is essentially a cheat sheet for this — go through it, cross-reference against your Google Workspace admin console and your GitHub org settings, and write down which scopes you're actually willing to grant. The default install path grants more than most orgs will be comfortable with once they see the list.
Second, treat every shared document as untrusted input to your agent, not just documents from outside the org. The interesting prompt-injection attacks in 2026 aren't email from strangers — they're the shared Notion page a compromised vendor account edited last week, or the calendar invite from a phished coworker. If your threat model still assumes "internal" means "safe," ChatGPT Work will expose that assumption fast.
Third, decide now what you'll do when — not if — the agent takes an action you can't undo. Sends an email. Merges a PR. Books a flight. The refund path for autonomous agent actions is a policy question, not a technical one, and it's better answered before the first incident than during it.
Willison's post won't slow ChatGPT Work down — nothing will — but it does raise the floor on what a serious enterprise evaluation looks like. The next six months will separate the orgs that read posts like this from the ones that don't, and the difference will show up not in whether they adopt agentic AI but in whether they can explain, six months in, what it actually did on their behalf. If your answer to that question is "we'd have to check the logs, if we have them," you already know what to fix first.
Top 10 dev stories every morning at 8am UTC. AI-curated. Retro terminal HTML email.