You asked an AI agent to "find me the best option and book it", it spent twenty minutes clicking, and you ended up with a cart you did not want. The fix is rarely a smarter model. It is picking a better task and writing a tighter brief. That holds for ChatGPT agent mode and for every other browser agent.
One caveat first, because it changes how you should read the rest of this post. ChatGPT agent mode may no longer exist in the form people describe it. I tried to read OpenAI's help article and pricing page on 2026-10-09 (and again during editing, with a browser user agent) and every request to help.openai.com, chatgpt.com and openai.com returned HTTP 403. Only the API developer docs were readable, and they are not where a consumer product's availability is stated. A web search summary of the help article said it now states that ChatGPT agent is no longer available and points to a product called ChatGPT Work for longer multi-step tasks. Secondary articles in the same search described browser workflows being handled separately. I could not confirm any of that on OpenAI's own pages. So this post teaches the part that does not expire: which tasks suit a browser or computer agent, and how to brief and supervise one. Check the current OpenAI help article for your plan for the product details.
What is ChatGPT agent mode, and where does it stand today?
As originally described by OpenAI, it let ChatGPT use its own virtual browser and tools to carry out a multi-step task for you. That description comes from memory of the launch era, not from a page I read today, so treat it as background only.
What I can say as of 2026-10-09:
| Question | Answer | Source status |
|---|---|---|
| Is the help article readable? | No, HTTP 403 | Tried help.openai.com/en/articles/11752874-chatgpt-agent by WebFetch and curl |
| Does it still exist? | A search summary says no, replaced by "ChatGPT Work" | Not confirmed on OpenAI's pages |
| Monthly request caps by plan | Not quoted here | Only seen in a search summary of an older page |
| Can the replacement log into your accounts? | One secondary review said no for logged-in browser tasks | Unverified, competitor-adjacent sources exist in the results |
If your plan still shows an agent option, the sections below apply directly. If it shows ChatGPT Work or something else, apply them to whatever tool takes actions on your behalf. Related background on how agents are built is in what is an AI agent.
Which tasks are practical for a browser agent?
Sort candidate tasks by two questions: can the result be checked in under two minutes, and can a mistake be undone? Anything that fails both stays manual.
| Task | Fit | Why |
|---|---|---|
| Compare 5 public product or plan pages into a table | Good | Read-only, you can spot check every cell |
| Collect public contact or pricing details from a list of URLs | Good | Read-only, the sources are visible |
| Check a list of links for one specific fact | Good | Binary result per link |
| Fill a draft form and stop before submit | Okay | You review, then submit yourself |
| Triage a public listings page against your criteria | Okay | Judgement calls need your review |
| Book travel, buy something, pay a bill | Poor | Spends money, hard to undo |
| Send emails or post as you | Poor | Public and irreversible |
| Work inside banking, health or client accounts | Avoid | Screenshots capture whatever is on screen |
That last row is not a guess. Anthropic's own safety page for Claude in Chrome, which I read on 2026-10-09, says the tool takes screenshots of the tabs it works in, cannot filter sensitive content out, and advises against managing financial accounts, handling legal documents, processing medical information or accessing work accounts with sensitive company data. Google's Gemini Spark help page makes a similar point: do not type sign-in or payment details into a task thread, and avoid scheduling tasks that use sensitive information. Different vendors, same lesson.
How do I write a task brief an agent can follow?
Vague goals produce wandering runs. A brief that works has six parts. This is an untested template; I have not run it against any specific agent product.
GOAL: Compare the pricing pages of these 5 tools and produce a table.
URLS: (list them; do not search for others)
COLUMNS: tool name | cheapest paid plan | price per month | one limit that matters | page URL
RULES:
- Read only. Do not sign in, click Buy, Subscribe, Start trial, or submit any form.
- If a value is not on the page, write NOT FOUND. Do not estimate.
- Record the date you read each page.
STOP AND ASK ME IF: a page asks for login, a cookie wall blocks content, or you are about to leave the listed URLs.
OUTPUT: the table, then a list of anything you could not read.
Why each part is there:
- URLS stops the agent from deciding which sources count. Open web search is where injected instructions and low-quality pages come in.
- NOT FOUND gives it a legitimate way out. Without that, agents tend to fill the cell.
- STOP AND ASK turns surprises into pauses rather than improvisation.
- Record the date makes your check later easier, since vendor pages change often.
How should I supervise the first run?
Run every new brief supervised before you trust it. Use this checklist.
- Separate browser profile. Create one with no saved logins to banking, email, health or work tools. Anthropic's safety page recommends exactly this.
- Watch the first run live. Keep the take-over or stop control in reach. Gemini's help page describes a Stop control and a Take over option; if your agent has no equivalent, do not leave it unattended.
- Spot check at least three cells against the source page. If one is wrong, the whole table is suspect.
- Check where it went. Compare the pages it actually visited with your URL list. Extra sites are a flag.
- Stop on strange behaviour. Anthropic's guidance: if the agent starts discussing unrelated topics, visits unexpected sites or asks for sensitive information, stop the task. That can be a sign of a prompt injection hiding in a page.
- Only then schedule it. If you schedule recurring runs, remember Google warns you may not be able to stop an unintended action if the schedule runs while you are offline.
What about prompt injection?
A web page can contain text that is addressed to the agent rather than to you, for example hidden in a review or a footer. The agent may treat it as an instruction. Anthropic's page calls this the biggest risk for browser-using AI tools and says the risk is not zero even with classifiers. The practical defences are the ones above: read-only briefs, listed URLs, no sensitive accounts, and a human at the submit button. For a deeper treatment of the threat model, see prompt injection for tool-using agents and the prompt injection lesson. I deliberately do not include example attack strings here.
Three worked task ideas to adapt
These are templates, not captured runs. Outputs would vary by agent and date.
Plan comparison for a tool you are choosing. Use the brief above. Ask for one limit that matters (seats, usage cap, export). Then verify the winner by hand on the vendor's page before paying.
Dead link and claim check for your own site. List 30 of your own URLs. Ask: "For each URL, report HTTP-visible status in the page (loads, error, redirect) and whether the sentence I quote still appears." Read-only, your own content, easy to check. If you need this at scale, a script is cheaper and more reliable than an agent.
Draft a form, never submit. For a vendor registration or supplier form: "Fill every field you can from the attached details, leave the rest blank, do not click the final button, tell me which fields you left blank." You review and submit.
When is a browser agent the wrong tool?
- The site has an API or export. Use that.
- The task repeats thousands of times. Write code; agents are slow and variable.
- The cost of one wrong action is high. A person should do it.
- You need a reproducible audit trail. Scripted automation such as the approach in Stagehand browser automation is easier to test, and Claude computer use workflows covers the developer-side alternative. For a side-by-side of the current consumer browser agents, see AI browser agents compared.
What I could not verify
- OpenAI's current agent or ChatGPT Work availability, plans and limits (pages blocked; search summary only).
- Whether any specific ChatGPT plan shows an agent option today.
- That the brief template above works unchanged in any particular product. It is untested.
Check the primary pages yourself, and tell your future self the date you checked.
