Simon Willison maps what ChatGPT Work actually does, including 223 tools and 44 skills

Sources: primary, discussion, second thread
Summary: OpenAI announced ChatGPT Work on 2026-07-09 and documents it by what it is for rather than what it does. Willison separates it into a cloud version reached through chatgpt.com and the mobile apps and a local version in the desktop app that was previously Codex, then enumerates what the cloud version has that Chat does not: a code execution environment whose internet access defaults to open rather than to an allowlist, a full headless Chrome that runs JavaScript against the DOM and can hand over to the user for sign-in without routing credentials through the model, a /workspace filesystem persisted and shared across sessions, sub-agent sessions, and site deployment onto Cloudflare Workers with D1 and R2. He then had a Work session enumerate its own tooling and published the result as a reference listing 223 registered tools, 6 of them his own MCP servers, and 44 skills. Access is limited to subscribers at 20 dollars per month and above.
Why it matters: Willison states the product combines all three legs of his lethal trifecta, private data access, exposure to untrusted content and an exfiltration path, and that OpenAI has not explained how Work sessions are defended against prompt injection.