Introduction to Operator & Agents

AI agents are moving from chat-based assistance into hands-on work: Operator is an OpenAI system that can take control of a remote web browser, interpret what’s on the screen, and complete real tasks—like booking reservations, shopping for groceries, and buying event tickets—using only the same kind of visual input and keyboard/mouse actions a person would use.

Operator launches as an early research preview with a browser-in-the-cloud interface. Users type a request, and Operator opens a remote session, navigates websites, and performs actions by clicking, typing, and iterating based on fresh screenshots. In a reservation demo, it searched OpenTable for a restaurant in San Francisco and handled availability changes by proposing an alternate time when the requested slot wasn’t available. It also demonstrated “human-in-the-loop” checkpoints: before irreversible actions, Operator asks for confirmation so users can cancel or approve.

A second demo focused on grocery shopping through Instacart. Operator used vision to read an uploaded shopping list image (eggs, spinach, mushrooms, chicken thighs, chili crunch) and then added items to a cart by repeatedly observing the screen, planning the next step, and acting. The workflow followed a tight loop: take a screenshot, decide what to do next, click or type, then capture the updated screen to verify the effect—continuing until the task is complete or the system requests help.

Operator’s underlying research model is “Computer Using Agent” (CUA), built off GPT-4o but trained to control a computer directly. The key shift is avoiding reliance on website APIs. Instead of needing structured integrations for each service (like Instacart), CUA learns to operate through the universal interface of pixels plus keyboard and mouse. That design choice aims to remove a major bottleneck for agent deployment across the web.

The system also includes a takeover mode. Users can seize control of the remote browser, make changes privately, and then hand it back to Operator. The session is described as private during takeover, and the system can’t see what the user does in that mode beyond the last screenshot.

Because real-world actions carry risk, Operator is wrapped in a layered safety approach centered on misalignment. It uses refusals for harmful requests, moderation and detection mechanisms, and blocks suspicious instructions. When the model might be wrong, confirmations are used before impactful steps like purchases or reservations. When websites might be untrusted or malicious, a “prompt injection monitor” can pause the agent’s trajectory if something looks suspicious.

Reliability is still imperfect—Operator is explicitly positioned as a research preview that makes mistakes. Performance is quantified with evals: CUA scores 38.1% on OSWorld (Linux-style operating system navigation) and 58.1% on Web Arena (website navigation), both above other publicly published results but below human performance. The rollout begins with Pro users in the United States, with other regions later, plus plans to expand access and launch an API in the coming weeks.