OpenAI dots in a business: invoices, payments and NDA risks

For one person's errands that is useful. For the parts of a business where a mistake costs money or trust, such as invoices, payments, contracts and documents under NDA, it is not ready. OpenAI's own documents show why, even though its safety numbers are good.

What a dot is

Its own computer. Each dot runs on a separate cloud computer with a browser, and works through ChatGPT's plugins: mail, calendars, Slack, CRMs, project trackers. The model underneath is OpenAI's GPT-6 Astra.
Memory. It starts with what ChatGPT remembers about you and keeps its own notes, including what it learns from connected apps.
Initiative. When nothing is assigned, it reads your connected apps looking for ways to help. In that mode it cannot send or change anything.
Rules. For supported actions you choose: act alone, act only when you asked for it, ask first, or leave it to you. An automatic review checks certain planned actions against your instructions, your rules and OpenAI's safety requirements. Changing a password or transferring money always comes back to you to complete.

What OpenAI's own tests show

OpenAI tested GPT-6 Astra on deliberately hard tasks in workplace apps: email, messaging, browsing, project management, sales, with ambiguous instructions and tangled permissions. In the general setup, 3.0% of tasks ended in an outcome nobody intended, against 8.0% for the previous model, GPT-5.6 Sol. OpenAI then ran a harder subset of the same tests through dots, with a confirmation policy written for them: 0.84% of tasks went wrong. It also sent dots 16,600 malicious emails, some of them trying to divert payments, and reports no successful attack.

That is real progress, and it is fair to say so. OpenAI itself adds three things. These rates are not necessarily representative of everyday use. Its protections against malicious instructions "help reduce the risk", but "do not eliminate it". And a dot can make mistakes, including when following your rules, so consequential work should be reviewed.

Below one percent is not zero, and an agent that works around the clock runs a lot of tasks. The question for a business is where the rest lands, and who is left to catch it.

Payments and invoices

OpenAI has drawn one line itself: a dot does not move money. Transfers come back to you to complete, and a card purchase needs an approval that covers that purchase.

That moves the risk rather than removing it. A dot reads your incoming mail and prepares work from it. When it prepares a payment from a supplier's email, or drafts an invoice from a thread, the person who clicks "pay" or "send" is approving work they did not do. One early tester's dot noticed an invoice that was never sent, prepared it and sent it after approval. If the amount, the VAT line or the client had been wrong, that click would have been the only check, and it depends on a busy person reading carefully.

Finance keeps preparing a payment and approving it in separate hands for a reason. With a dot, the preparing is done by software that nobody has measured on your documents, and the approving is done by someone who rarely redoes the work. In our own tests, an open model left without rules put a due date on a credit note, which is a refund and has no due date. A written rule removed that mistake. A dot has no such rules unless someone builds them.

Contracts and important documents

The trouble with documents is that the mistakes do not look like mistakes. In our tests this year we gave three models, Qwen, Gemini and Claude, a contract with no fixed term and told them to answer "null" if a value was missing. All three answered "48 months", with the same confidence as a correct answer. None of them is OpenAI's, and it was not a test of dots. It is how language models fail on documents in general: nothing in a plain summary tells the reader which line was invented.

What protects a company is what surrounds the model: a pass mark agreed in advance, a measurement on your own documents, and checks that compare each value with the source. A dot does not include any of this. OpenAI's advice is to review its work, which leaves the checking with you.

Confidential data and NDAs

It runs in OpenAI's cloud. There is no version of dots for your own servers.
It remembers. Disconnecting an app stops new access, but does not remove what the dot already learned from it. Today you cannot view or delete individual dot memories. The only way to clear them is to delete the dot.
It reads when idle. In its background mode it goes through connected apps looking for ways to help. It cannot send anything then, but it reads.
People may look. OpenAI says human review can happen in limited cases, including safety cases, even when model improvement is turned off. Many cloud services have a similar clause. For documents under NDA it still counts.

Many NDAs limit who may see the other side's information: your staff, your advisers, sometimes only named people. Connecting a mailbox full of such documents to an outside agent may already count as disclosure. That is a question for your lawyer, and it is better asked before the mailbox is connected than after.

Cost after the first month

The first dot is included in two plans, Pro and Business Premium. A Business Premium seat is $125 a month per person, or $100 billed annually, and works in every region ChatGPT supports. The Pro plan does not offer dots in the European Economic Area, Switzerland or the UK. Talking to a dot does not count against plan limits. Its own work draws on an allowance that is extended only for the first month, and tasks it starts in Codex or ChatGPT Work count against those limits as usual. OpenAI has not published what extra capacity will cost, so the running cost of a process built on a dot is not yet known.

Where a dot is fine

A dot is an assistant for one person, and it fits where no money moves and no confidential document is involved: follow-ups after meetings, reminders, a weekly summary of customer feedback, research before a call. The person approves every step that matters, and a mistake is seen by the one person about to approve it.

If your team tries dots, write a short policy first. No dots on payments, invoices or anything under NDA. Everything that sends, buys or shares set to "ask first". Only the apps the task needs. One named owner for each dot. Then, for a month, count how many of its drafts went out unchanged and how many were wrong. That number tells you more than any demo.

What a business needs instead

Invoices, payments and contracts are processes, not errands. OpenAI treats them differently too: its "specialist dots" for procurement, invoice processing, email marketing, customer support and commercial contracting start as enterprise pilots, with OpenAI engineers working directly with each organization.

A process like that needs four things a general agent does not bring:

A pass mark agreed before the first run, so "good enough" is decided in advance, not after a demo.
A measurement on your own documents, with every failure shown, not just the score.
Written checks. Net plus VAT equals the total. A due date comes after the issue date. Every value is found in the source. Bank details are compared with the supplier record, not with the latest email.
A place where the data is allowed to be. Your own servers, when an NDA or the law requires it.

That is what we build. We measure the process on a sample of your documents, agree the pass mark with you, and put the checks around the model, on your servers when the data cannot leave them. The work is priced as a fixed project, with no meter on usage. To start, write to contact@unrote.ai with the process you have in mind.

A dot can remind you to send an invoice. It should not be the one who sends it.

Sources

OpenAI, GPT-6 Astra System Card: Table 8 "Misaligned outcomes in realistic work environments", and the dots appendix, sections 12.2.1 and 12.3.3
OpenAI Help Center, Dots privacy, security, and safety FAQs
OpenAI, Premium seats in ChatGPT Business
Launch coverage quoting OpenAI's announcement and help pages: 9to5Google, The Next Web, MarkTechPost, DataCamp (29-30 September 2026).