Simon Willison · 2026-08-30 · notable
Simon Willison — what ChatGPT Work gives you that plain ChatGPT does not
Simon Willison unpacks ChatGPT Work, finding 223 registered tools and 44 skills behind it, and warns that its mix of private data, untrusted content and outbound network access is the lethal trifecta.
Simon Willison maps the 223 tools and 44 skills inside ChatGPT Work, and flags the lethal trifecta its sandbox creates.
What is it?
ChatGPT Work is really two products, and Simon Willison separates them: Work Cloud, which runs on chatgpt.com, and Work Local, a desktop app. His post covers Work Cloud only. He documented it by using ChatGPT Work itself to build a public reference site listing the 223 tools and 44 skills it exposes.
How does it work?
Work Cloud lets you pick between the GPT-5.6 Sol, Luna and Terra models at several reasoning levels, and gives the model a code sandbox with unrestricted internet access, a full headless Chrome browser, a filesystem that persists across sessions, sub-agents for parallel work, and scheduled prompt automations. Willison notes it can also deploy websites through Cloudflare Workers.
Why does it matter?
Willison argues that combination is the lethal trifecta — "access to private data with exposure to untrusted content and a way to communicate stolen information back to an attacker" — which is the setup prompt injection needs to exfiltrate data. He also criticizes OpenAI's documentation for describing what the product is for rather than what it can technically do, and for withholding system prompts and tool descriptions. Access starts at $20/month.
Who is it for?
developers evaluating agentic ChatGPT tiers and their security teams