ChatGPT Agent Mode at Work: What It Can Do on an Employee's Behalf, What Admins Can Switch Off, and What Happens on Personal Accounts

Direct answer: ChatGPT agent mode lets ChatGPT browse websites, fill forms, run multi-step tasks and act inside connected apps on a user's behalf, and in ChatGPT Enterprise it is off by default until a workspace owner switches it on. That toggle governs only your workspace. A personal ChatGPT account with agent mode enabled, running on a corporate laptop, is invisible to your Enterprise admin settings and can act on any site the employee is logged into. The only control that covers every account is on the device: block personal ChatGPT logins while allowing your Enterprise tenant, then inspect what the agent sends and uploads. That is what dope.security's Cloud Application Control and Dopamine DLP do, and it is the gap this post is about.

Agent mode has had a busy eighteen months. OpenAI introduced the ChatGPT agent in July 2025, then launched ChatGPT Atlas, a standalone macOS browser with agent mode built in, on October 21, 2025. On July 9, 2026 OpenAI announced it was discontinuing Atlas, and the browser stopped working on August 9, 2026, 292 days after launch. The agentic browsing capabilities did not go away; OpenAI folded them into the ChatGPT desktop app, the ChatGPT Chrome extension and Codex. For IT teams that means the thing to govern is no longer a browser you can refuse to install. It is a feature inside an app most employees already have, reachable from a personal account as easily as a corporate one. We covered the earlier browser wave in AI browser governance; this post is the agent-mode follow-up.

Below we explain what agent mode does, which controls OpenAI gives Enterprise admins, where those controls stop, and how to govern agent mode across every ChatGPT account on your fleet without banning the tool your sanctioned users are paying for.

What does ChatGPT agent mode actually do?

In agent mode, ChatGPT stops being a chat window and becomes an operator. Given a task such as "find three vendors that meet these requirements and fill in their contact forms," it opens pages, reads them, clicks, types, scrolls and submits, narrating as it goes and pausing to ask for confirmation at points OpenAI classifies as sensitive, such as purchases or logins. In the Chrome extension and desktop app it can act inside sites the user is already signed into, which is what makes it useful and what makes security teams nervous. With workspace agents, which OpenAI rolled out to Enterprise in 2026 with admin controls over which actions agents may take in each connected app, agents can also run against connected data sources such as Google Drive, SharePoint or Slack.

At launch OpenAI described guardrails that still frame the feature: the agent cannot run code in the browser, cannot install extensions, cannot reach other applications on the machine, and pauses on sensitive sites. Those limits reduce the blast radius. They do not change the fundamental fact that an AI model is now reading and acting on whatever the user's browser can see, including internal web apps, customer records and the contents of a logged-in SaaS session.

What can a ChatGPT Enterprise admin control?

OpenAI gives workspace owners and admins a reasonable set of switches, according to its help documentation and Enterprise release notes. Agent mode and workspace agents are off by default on Business and Enterprise plans until an owner enables them. Agent access is governed from the workspace permission settings, and role-based access controls can limit which members get it. For workspace agents, admins can set which actions agents may take per connected app. Enterprise content is not used to train OpenAI models. SSO and SCIM apply to the workspace, so the identity layer is yours. During the Atlas period OpenAI also noted gaps worth remembering: no IP allowlists or private egress, no enterprise update channel, limited extension and browser policy management, and some agent and browsing data types that may fall outside Enterprise retention and deletion commitments. Confirm the current state of each of those in OpenAI's documentation before you rely on them, because the feature set has moved quickly.

Used well, these controls let you run agent mode as a sanctioned capability: enable it for a pilot group, scope what workspace agents can touch, and audit the results. That is the right way to adopt it. The problem is everything outside the workspace boundary.

Where the Enterprise toggle stops

Every one of those controls applies to users signed into your ChatGPT Enterprise workspace. None of them apply to an employee signed into a personal ChatGPT Plus or Pro account on the same corporate laptop, and personal accounts have agent mode too. The scenario is ordinary: an employee hits a feature your workspace disabled, or just prefers their personal history, opens chatgpt.com or the desktop app with a personal login, and asks the agent to pull together a report from the internal wiki, a customer portal and a spreadsheet. The agent operates inside a browser that is logged into your systems. Your Enterprise admin console never sees the session. Your retention and training commitments do not cover it. And the data the agent reads goes to an account you have no contract with.

This is the same gap we described for prompts and uploads in ChatGPT Enterprise governance in three layers, made sharper by agency. A prompt leaks what the user pastes. An agent leaks what the user can see. Domain blocking cannot fix it, because the Enterprise workspace and the personal account share chatgpt.com and the same desktop app binary. Telling them apart requires looking inside the decrypted session at the account the user is signed into.

Head to head: ways to govern ChatGPT agent mode

IT teams typically weigh four approaches. Each paragraph stands alone.

ChatGPT Enterprise admin settings alone

The workspace toggle, RBAC and per-app action controls are the right tool for the sanctioned tenant and should be configured first. They have no reach into personal accounts on corporate devices, no visibility into which employees use a personal account at all, and no inspection of the content the agent sends. OpenAI positions them as workspace governance, not device governance, which is accurate.

Browser extensions and managed-browser policies

A managed browser can block the ChatGPT Chrome extension and an enterprise browser extension can watch prompts inside the browser. Neither sees the ChatGPT desktop app or Codex, where the agentic capabilities now also live, and neither can enforce which account the user signs into unless it inspects the session. Users can also switch to an unmanaged browser.

Cloud proxy SWG with an AI add-on

Zscaler, Netskope and similar platforms can inject or inspect the tenant header inside decrypted TLS once traffic is tunneled through their data centers, and their AI SKUs add prompt inspection. The control is real; it arrives with proxy latency on every request and, in each case, as an additional tier or product family. Zscaler's prompt DLP requires its Data Protection add-on, and its agent-traffic product announced in June 2026 had undisclosed pricing and availability.

On-device tenant control plus endpoint DLP (dope.security)

dope.security inspects SSL on the endpoint, so it sees the ChatGPT account the user signs into, in the browser and in the desktop app, with no backhaul. Cloud Application Control allows your Enterprise workspace and blocks personal logins to the same domain. AI Analytics show agent and chat usage by user, split into personal versus enterprise-licensed accounts. Dopamine DLP reads what the agent sends and uploads, classifies it by meaning and blocks sensitive content before it leaves the device, with zero data retention (US Patent 12,464,023). Policy lands on every endpoint in under a minute from one console, and the agent runs under 100 MB of RAM on Mac and Windows.

• Scope: OpenAI's toggle covers your workspace; dope.security covers every ChatGPT account on the device.
• Surface: browser extensions cover one browser; dope.security covers browser, desktop app and Codex traffic alike.
• Path: cloud proxies detour traffic to a PoP for inspection; dope.security inspects locally with no detour.
• Licensing: cloud proxies sell AI controls as add-ons; dope.security ships tenant control and Dopamine DLP in the base product.

How to govern agent mode in four steps

Step 1: Decide the sanctioned posture in your workspace

Enable agent mode for a defined pilot group in ChatGPT Enterprise, scope workspace agents to the connected apps you actually want them touching, and document what the agent may and may not do in your AI usage policy. If you decide agent mode stays off for now, that is a valid posture too; the rest of the steps still apply, because personal accounts ignore your decision either way.

Step 2: Measure personal-account ChatGPT use on your fleet

Run dope.security's AI Analytics in monitor mode for one to two weeks. Look at ChatGPT usage by user and at the personal-versus-enterprise split. It is common to find a meaningful share of ChatGPT traffic on personal accounts even when every employee has an Enterprise seat. That number is your actual agent-mode exposure.

Step 3: Enforce the tenant on the device

Turn on Cloud Application Control for ChatGPT: allow your Enterprise workspace, block personal logins. Because enforcement happens on the endpoint inside decrypted TLS, it applies in the browser and in the desktop app, at home or in the office, and it does not depend on a proxy being reachable. Our step-by-step guide to blocking personal ChatGPT while allowing ChatGPT Enterprise shows the configuration.

Step 4: Inspect what the agent sends

Even in the sanctioned workspace, an agent summarizing a customer portal can push regulated data into a prompt. Set Dopamine DLP to monitor first, review the Dopamine summaries that explain in plain language why each detection fired, then move the categories you care about to block. Coverage spans ChatGPT, Claude, Perplexity, Abacus and Copilot, so the same policy follows employees to the next tool.

What about Codex and the Chrome extension?

Since Atlas was retired, OpenAI's agentic browsing lives in three places: the ChatGPT desktop app, the ChatGPT Chrome extension and Codex, which also runs as a CLI and IDE companion. From a governance standpoint the important property is shared: all three authenticate to a ChatGPT account and send traffic to OpenAI endpoints over HTTPS. A control that keys off the account inside the session, rather than off a browser or a domain, covers them together. That is the design reason an on-device SWG handles this category better than a browser-bound tool, and it is the same reasoning we laid out for autonomous agents generally in Agentic AI security: a practical governance guide. A Fortune 100 customer deployed dope.security to more than 18,000 devices in weeks with the agent pushed silently through Intune, which is the kind of coverage this problem needs.

The bottom line for IT and security leaders

Agent mode is worth adopting and worth governing. Configure OpenAI's workspace controls for the tenant you pay for, then close the gap they cannot reach: personal accounts on corporate devices, desktop and CLI surfaces, and the content the agent moves. See how dope.security governs ChatGPT and other AI tools from the endpoint, or watch the AI governance and DLP demo to see tenant control and Dopamine DLP on a live laptop.

Restating the thesis: the agent-mode switch in ChatGPT Enterprise governs your workspace and nothing else, so the personal accounts running agent mode on your laptops need a control that lives on the device, not in OpenAI's admin console.

Frequently Asked Questions

Is ChatGPT agent mode turned on by default for Enterprise users?

No. According to OpenAI's documentation, agent mode and workspace agents are off by default on Business and Enterprise plans until a workspace owner enables them, and access can be limited by role. The default only applies to accounts in your workspace; personal ChatGPT accounts control their own agent-mode setting. dope.security's Cloud Application Control is how you keep those personal accounts off corporate devices.

Can agent mode access internal company websites?

Yes, if the user's browser is logged into them. In the Chrome extension and desktop app the agent operates inside the user's authenticated sessions, which is what lets it complete real tasks. OpenAI's guardrails pause on sensitive actions but do not distinguish an internal portal from a public site. On-device inspection with dope.security lets you see and control which account the agent is running under and what data it sends out.

What happened to ChatGPT Atlas?

OpenAI announced on July 9, 2026 that it was discontinuing Atlas, its standalone macOS browser launched in October 2025, and the browser stopped working on August 9, 2026. OpenAI moved the agentic browsing capabilities into the ChatGPT desktop app, the ChatGPT Chrome extension and Codex rather than keeping a separate browser. Governance now has to cover those surfaces instead of a single installable app.

Can I block ChatGPT agent mode but still allow ChatGPT?

Inside your Enterprise workspace, yes: leave agent mode disabled in permission settings while members keep using chat. For personal accounts you cannot toggle the feature, so the practical control is to block personal ChatGPT logins entirely while allowing the Enterprise tenant. dope.security does that on the device for the browser and the desktop app.

Does a DNS filter or web proxy stop personal ChatGPT agent use?

A DNS filter cannot, because the Enterprise workspace and personal accounts share chatgpt.com. A cloud proxy can, if it decrypts TLS and injects or inspects the workspace header, typically with an AI or data protection add-on and with every request detouring through the vendor's data center. dope.security performs the same tenant control on the endpoint with no detour and no add-on.

Does Dopamine DLP see what an agent sends, not just what a user types?

Dopamine DLP inspects the prompts and file uploads that leave the device for supported AI tools, classifies them by meaning with an LLM and blocks or monitors them before they leave the laptop, with zero data retention. How much agent-assembled context passes through that path depends on how the ChatGPT client transmits it, so pair DLP with Cloud Application Control, which governs the account the agent runs under regardless of what it sends. Coverage includes ChatGPT, Claude, Perplexity, Abacus and Copilot.