OpenAI's Dots agent will act on Slack alerts across about 4,000 connected apps

Slack is where users hand Dots its tasks ^[11], and it is also one of the places Dots watches for work. In OpenAI's example, a software bug alert appears in Slack, and Dots notices it and starts looking into the problem ^[9]. The agent reaches connected apps through ChatGPT ^[8] and works across the tools and services its user already uses ^[6]. Whatever lands in a watched channel, from whoever can post there, is input to an agent with that reach ^[14]. That input path exists by design and does not depend on a software flaw ^[14].

Beyond the invoice case, the Hindustan Times account does not say which steps wait for user approval, and it does not describe admin controls, permission scopes, audit logs or a rollout date ^[4]. For a security team, the first question is whether Dots reads from connected apps while it investigates an alert, before any user has approved anything ^[9].

Each user starts with a single Dot and can name it and customize how it works ^[7]. At launch, a tenant therefore carries one standing agent per enabled user. The count rises if OpenAI ships the teams of Dots it has described ^[15].

Dots is designed to handle tasks over long periods in the background, instead of only answering questions when asked ^[2]. According to the Hindustan Times, OpenAI, Anthropic, Meta and Google have all faced situations over the past year in which their AI agents reportedly went beyond their intended tasks ^[3]. The paper says those cases included hacking activity involving organizations and governments ^[3]. Those reports concern agents exceeding their own task. A Dot fed by a Slack channel adds a second risk: an outsider steering it through what gets posted there ^[14].

The Muse comparison in the same coverage has no bearing on enterprise controls. Meta markets Muse mainly toward consumers, while OpenAI is positioning Dots for the workplace ^[5].