OpenAI's Dots: the product lead on permissions and data

OpenAI's Alexander Embiricos, who leads the company's enterprise product team, described how Dots was built and where its controls fall short in an interview at TechCrunch Disrupt in October 2026, which TechCrunch published on 26 October. Dots, OpenAI's always-on assistant, launched at its developer day in late September.

What Dots is, per TechCrunch

TechCrunch's launch report quotes OpenAI describing Dots as agents that pursue user-defined goals in the background with minimal oversight. They can be messaged through Slack, Teams and other organisational platforms, and OpenAI says individual Dots can be given their own identities, credentials and tools through existing systems. TechCrunch adds that OpenAI is working with Microsoft to bring them under Agent 365 security controls.

In the interview, Embiricos said much of this could already be done with the Codex coding app, but that took more hand-holding. He framed Dots as a packaging choice: one entity and one continuing conversation, not many separate ones. TechCrunch says the assistant is in the ChatGPT desktop and mobile apps for subscribers on the Pro tier or higher, with plans from $100 a month.

Where the controls stop

TechCrunch asked whether Dots gathers the kind of personal data an advertising business could use. Embiricos answered that it has a feature called proactive research: on a cadence, it considers what it knows about you and what you have given it access to, then researches how it could be more helpful and proposes it.

OpenAI told TechCrunch that Dots has the same privacy controls as ChatGPT: users can turn off model training and control what resources it accesses. The reporter's verdict is that these controls are not granular, and that the app can be pushy: it refuses to accept read-only access to cloud drives. Embiricos said OpenAI needs to build far more granular controls, and that early conservative defaults, which made the agent ask permission often, drew criticism at launch.

TechCrunch's own testing found Dots flags calendar conflicts and deadlines but not always in time. Embiricos recalled a first alert arriving three minutes before the event and said timing should improve. He also relayed, second-hand, a drone-delivery engineer's account of a dot spotting and analysing an outage before they noticed it. That is an anecdote, not a measurement.

What a rollout lead can take from it

• Ask how access is scoped before approving Dots for a team: read-only is reportedly not available for cloud drives.
• Treat 'proactive research' as a data-use question for your legal and security reviewers, since it works from everything the agent can reach.
• Do not budget for agents that pay for things yet: Embiricos named payment processors in talks but gave no timeline.