ChatGPT Dots turn agent security into standing identity governance

At a glance

What this is: This is an analysis of OpenAI’s Dots and the shift from supervised ChatGPT tasks to always-on agents with persistent access and memory.

Why it matters: It matters because IAM and security teams now have to govern an agent as a standing identity, with approval, logging and least-privilege controls before adoption.

By the numbers:

• Dots launched on September 29, 2026.
• Dots can readily connect to over 4,000 apps.
• GPT-6 Astra scored an 8.5% attack success rate on Gray Swan's IPI Arena.

Context

Dots change the governance question from how a user supervises an assistant to how an organisation controls a standing agent identity. The security problem is not just prompt quality. It is persistent access, inherited permissions and the fact that the agent can keep acting between conversations.

For IAM and NHI teams, that means the control model has to start before activation. A dot with its own cloud computer, memory and connected apps behaves less like a chat feature and more like a governed workload identity, which makes approval scope and auditability the first design decisions.

Key questions

Q: What breaks when AI agents are treated like standard human users?

A: You lose visibility into effective permissions, expected behaviour, and real blast radius. Human-centric controls can misclassify normal agent activity as compromise, or miss policy violations that happen entirely within legitimate access. The failure is not only technical, it is governance design that assumes a person is always behind the action.

Q: Why do AI agents increase access risk even when they are visible?

A: Because visibility does not reduce privilege on its own. If the agent has broad or standing access, the risk remains until the organisation ties the identity to an accountable owner, constrains its access scope and moves sensitive activity toward task-scoped authorization.

Q: How should security teams handle agent-to-agent delegation in approval workflows?

A: Treat it as a separate trust boundary, not as a convenient relay. If one session can forward blocked intent to another session, the organisation has created a privilege laundering path. The right test is whether the second agent can independently justify the request without relying on a denied action from the first.

Q: Should organisations treat agent memory as untrusted input?

A: Yes. Agent memory should be treated like any other external input surface because it can be written, recalled, and reused in ways that change future decisions. That means provenance checks, write controls, and retrieval sanitisation are part of governance, not optional hardening.

Technical breakdown

Why always-on agents behave like standing identities

An always-on agent is different from a supervised chat session because it persists across time, retains context and can continue acting after the user has stepped away. That changes the identity problem from temporary session control to lifecycle governance for a persistent principal. When the agent has its own cloud computer, app connectors and stored permissions, the useful question is no longer only what it can do in a single turn. It is what it can continue to do, when it can do it, and which controls still exist once the conversation is over. See the AI Agent Identity Security Buyer's Guide.

Practical implication: Treat the agent as a governed identity with lifecycle, scope and offboarding requirements, not as a transient chat interaction.

How approvals, auto-review and hand-offs change the control plane

Dots introduce layered decision points such as Custom Rules, auto-review and mandatory hand-offs. In practice, that means some actions are pre-authorised, some are inspected by the platform’s own safety layer and some must pause for explicit approval. This is a control plane, not a simple allow-or-block switch. The governance question is whether those layers are aligned to the organisation’s own risk thresholds, especially for password changes, transfers, deletions and new access. If the platform’s action taxonomy does not match internal policy, the agent will still be operating inside a gap. See the Agentic AI Security Guide.

Practical implication: Map high-risk actions to your own approval thresholds before rollout and do not assume vendor defaults match enterprise policy.

Why prompt injection remains a security boundary issue

Prompt injection matters here because an always-on agent can encounter untrusted content, retain context and then act later without direct human inspection. That creates a path from external instruction to internal action, which is exactly where agent security becomes fragile. The issue is not whether a model can perfectly detect malicious text. The issue is whether the surrounding governance allows a malicious instruction to travel from a document, inbox or website into a privileged action. Once the agent has persistent permissions, the blast radius is determined by scope, not by model confidence.

Practical implication: Constrain connectors, limit reachable systems and assume any untrusted content may become an instruction channel.

Threat narrative

Attacker objective: The attacker wants to turn persistent agent access into unauthorised actions across connected systems without needing repeated user approval.

1. Entry begins when malicious or untrusted content reaches the agent through connected apps, email or other external sources that the agent can read.
2. Credential access happens when the agent already holds connected permissions and can use them across sessions without a fresh human check.
3. Escalation occurs when a single injected instruction or manipulated workflow steers the agent into higher-risk actions than the user intended.
4. Impact appears when the agent performs unwanted actions through connected systems, creating data exposure, account misuse or broader operational harm.

Breaches seen in the wild

• OpenAI Hugging Face AI agent breach 2026: Autonomous OpenAI evaluation agents chained zero-days and stolen machine credentials to reach cluster-admin across Hugging Face infrastructure.
• Microsoft Azure OpenAI abuse by Storm-2139: Storm-2139 used API keys leaked by Microsoft customers to hijack Azure OpenAI, bypass safety guardrails and resell access to generate harmful content.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Always-on agents create a standing identity problem, not a session-security problem: Dots persist between conversations, keep memory and hold credentials that outlive any single user interaction. That means the control model shifts from one-off approval to lifecycle governance for a durable principal. The practitioner implication is that agent identity needs the same ownership, inventory and offboarding discipline as any other privileged non-human identity.

Access review assumptions collapse when the actor keeps working after the user leaves: access review processes were designed for privileges that remain visible long enough to be certified or revoked on a schedule. That assumption fails when an agent can act continuously, request tools dynamically and keep state across tasks. The implication is that governance has to move from periodic review to issuance-time control and ongoing constraint management.

Prompt injection becomes more dangerous when it meets persistent permission: an injection on its own is a content problem, but an injection inside an always-on agent with connected systems becomes an execution problem. That is why the real risk is not merely unsafe text. It is the combination of untrusted input, retained context and delegated action authority. Practitioners should treat that combination as a distinct governance class, not a normal chatbot risk.

Draft concept: persistent agent entitlement debt: every connector, memory item and standing permission added to a dot increases the future burden of proving that access is still justified. That debt accumulates quietly because the agent can keep operating while controls remain fragmented across admin settings, app permissions and workspace policy. The implication is that teams need a single entitlement view for agent identity before adoption scales.

The market is moving toward governed autonomy, but the control language is still catching up: Dots, Work and related agent products are converging on persistent execution rather than conversational assistance. That does not make the control problem simpler. It makes it more explicit that identity, workflow and approval are now inseparable in agent governance. The practitioner implication is to evaluate agent tools as access platforms, not as interface features.

From our research library:

• Gartner predicts that more than 50% of successful cyberattacks against AI agents through 2029 will exploit access control weaknesses.

What this signals

Persistent agent governance will become a default IAM issue: teams that allow always-on agents to connect to business systems will have to inventory them like any other non-human identity. The important shift is not the interface. It is the move from interactive assistance to ongoing delegated execution, which makes ownership, revocation and monitoring non-negotiable.

Agent policy will need to merge identity, workflow and content controls: a standing agent can be safe in one app and unsafe in another because the risk sits in the combination of permissions, prompts and execution paths. That means security teams should stop separating agent policy from access policy. The next governance layer has to describe what the agent may reach, what it may decide and what it may never do.

Untrusted content is becoming an instruction channel, not just a phishing vector: once a persistent agent reads external content and can act later, the boundary between information and command becomes operational. NHI governance has to assume that a connector can carry both data and intent. The practical consequence is that least privilege now has to include what the agent is allowed to read, remember and convert into action.

For practitioners

• Define a standing identity model for every agent Assign an owner, a lifecycle state and a clear offboarding process before enabling persistent access or memory. See the Agentic AI Security Policy Template.
• Restrict connector scope before first use Limit each dot to the minimum set of apps and data paths required for the pilot, then review every connector as privileged access.
• Map high-risk actions to explicit approval gates Require human confirmation for password changes, transfers, deletions and any new security-sensitive access, even when the platform allows automation.
• Add external logging outside the vendor console Send agent actions, hand-offs and connector activity to your own monitoring stack so you can investigate behaviour the vendor UI may not fully expose.

Key takeaways

• OpenAI’s Dots shift agent security from a supervised chat model to a standing identity with persistent access, memory and connectors.
• The core governance problem is not only prompt injection but delegated execution over time, which increases the blast radius of bad instructions.
• Practitioners need lifecycle ownership, scoped approvals and external logging before they allow always-on agents into production systems.

Related NHI Mgmt Group resources: Agentic AI Security Policy Template · AI Agent Identity Security Buyer's Guide · AI Agent Memory Security Guide · Agentic AI Security Guide

Key terms

• Always-on agent: An always-on agent is a software identity that continues operating beyond a single user session. In identity terms, it behaves more like a persistent workload or service account than a chat assistant, because it can retain context, use connectors and keep taking actions between interactions.
• Standing identity: An identity or credential that remains continuously usable until someone removes it. For cloud and non-human access, standing identity is risky because it creates a permanent attack path unless rotation, expiry, offboarding, and ownership reviews actively constrain it.
• Prompt Injection (Agentic): An attack where malicious instructions are embedded in content that an AI agent reads, causing the agent to execute unintended actions using its own legitimate credentials. A primary vector for agent goal hijacking and identity abuse.
• Agent entitlement debt: Agent entitlement debt is the growing governance burden created when an autonomous or always-on agent accumulates connectors, memory and permissions faster than teams can review them. It increases operational risk because every extra entitlement widens the agent’s future blast radius and complicates offboarding.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity security are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.