OpenAI Dots and Your Website: How to Spot, Allow or Block Them

OpenAI announced dots at DevDay on 29 September 2026. A dot is an always-on personal agent inside ChatGPT. It has its own cloud computer and its own browser, it connects to the apps its user chooses, and it keeps working on goals while the user is away. When a task needs a website, the dot opens that website itself.

For a site owner this raises practical questions. What does a dot look like in my logs? Can I tell it apart from a scraper? Should I let it in? This guide answers them from OpenAI's own documentation. If you want to see which named agents already visit you, the free AI agent log checker reads your logs in the browser. Dots, as you will see, need a different check.

What a dot is

The OpenAI launch post calls dots "remarkably capable, always-on agents built to handle everything." They are powered by GPT-6 Astra, they "have their own cloud computer, learn from feedback over time, and can work towards your goals 24/7", and through OpenAI's plugins they can connect to "over 4,000 apps".

People talk to their dot in ChatGPT on desktop, web and mobile, and also in Slack and Teams, with texting "coming soon". A dot can call, message and report back. The idea is that you give it a goal once and it follows through over days or weeks.

What matters for your website is this line from the same post: "Dots can do nearly anything using their own cloud computer, their own browser, and the apps you've connected." When a dot needs to check a price, book a slot, fill a form or download an invoice from your site, it does so in that browser.

The key facts at a glance

Personal dots and specialist dots

OpenAI describes two kinds. A personal dot "works on your behalf". A specialist dot takes on "dedicated responsibilities within your organization", with "its own identity, credentials, and access to the systems it needs". Specialist dots are in focused enterprise pilots, including an integration with Microsoft Agent 365. For a public website, both kinds arrive the same way: through a cloud browser, acting for someone.

How dots reach your website

The dots safety post explains the setup. "Each dot has its own cloud computer, where it can browse, analyze information, create files, and run tools." OpenAI isolates users' cloud environments from one another and maintains "the underlying Linux operating system and Chrome browser".

From your server's side that means:

• A real Chrome browser on Linux. Scripts run, cookies are set and forms submit like any visit. Your analytics script will usually record the session.
• Cloud IP addresses. Requests come from OpenAI's infrastructure, not from the user's home. Firewalls that distrust data-centre traffic may challenge them.
• Signed requests. ChatGPT's Cloud browser adds three headers that identify it cryptographically. This is the part that makes dots verifiable.
• Sometimes the user's own computer. OpenAI says a user can "give your dot permission to connect and use your laptop". Traffic sent that way comes from the user's own network, like a normal visit.

Why you will not find "dots" in your logs

Many site owners search their access log for a new agent's name and find nothing. With dots, that is expected. OpenAI does not document a dots user-agent token, and the Cloud browser is a standard Chrome build. The identity lives in the signature headers instead, and standard access logs do not record those.

OpenAI's Cloud browser allowlisting guide lists exactly what each request carries:

• A Signature header.
• A Signature-Input header.
• A Signature-Agent header set to "https://chatgpt.com", including the quotation marks.

Public keys for checking the signatures are at the public key directory. The format follows RFC 9421, the IETF standard for HTTP message signatures, under the profile called Web Bot Auth.

How to see dots traffic

1. Use your CDN's bot analytics. Cloudflare, Akamai, HUMAN and Vercel already identify the traffic as ChatGPT Agent. Filter by that bot name. This is the simplest and most reliable view.
2. Log the Signature-Agent header. If you run your own server, add the header to your log format. A request with Signature-Agent: "https://chatgpt.com" claims to be ChatGPT's Cloud browser; the signature tells you whether the claim is true.
3. Paste the header into our checker. The AI agent log checker accepts a pasted Signature-Agent line and tells you which operator it points to. It does not verify the cryptography; your CDN or a verifier library does that.

log_format agents '$remote_addr - [$time_local] "$request" $status '
                  '"$http_user_agent" sig_agent="$http_signature_agent"';
access_log /var/log/nginx/agents.log agents;

grep 'sig_agent="\"https://chatgpt.com\""' /var/log/nginx/agents.log | tail -50

A header can be copied as easily as a user agent, so a match is a claim until the signature is checked. That is why the CDN route is better for most sites.

Dots, ChatGPT-User, GPTBot and OAI-SearchBot

OpenAI runs several automated clients, and each needs a different decision. This is the most common source of confusion we see.

So blocking GPTBot in robots.txt to stop training has no effect on dots. Allowing OAI-SearchBot to appear in ChatGPT search does not let dots in either, if your firewall challenges them. Our guide to GPTBot vs ChatGPT-User vs OAI-SearchBot covers the crawler side in depth.

What dots will and will not do on your site

OpenAI has published more detail on dots' action rules than on most agents. The dots safety post and the dots privacy and safety FAQ describe three levels.

Two more safeguards affect how dots behave on websites.

• Auto-review. Before a dot takes an action such as sending an email or changing files, "a separate safety system called Auto-review checks the planned steps against your instructions, Custom Rules, and safety requirements." OpenAI keeps the controls for it outside the dot's own environment, "so they cannot change or turn off a required check".
• Secure sign-in. For supported sign-ins, "the model is paused while you complete a secure login form", and saved passwords are supplied by an encrypted credential service "without passing it to the model". If your site asks for a two-factor code, the FAQ says the user "may need to provide an authentication code or take over".

OpenAI is also clear about limits: "Dots can still make mistakes, so always review consequential work." From your side, that means your normal confirmations, receipts and cancellation flows still matter.

Prompt injection: your pages are data, not orders

OpenAI warns that "a webpage, email, or document can contain malicious instructions" that try to redirect an agent, and says dots are designed "to distinguish your instructions from content it encounters while working". In short, text on your page does not give a dot permission to do anything. Do not try to "instruct" visiting agents with hidden text; it will not work and it can look like an attack.

Should you allow dots?

For most businesses, yes. A dot on your site is working for a person who wants something from you: an appointment, a quote, a product, an invoice. Turning it away usually means that person goes elsewhere.

The AI Agent Readiness Check shows whether a cloud browser can load your key pages or meets a challenge, a refusal or a login wall. It is the closest public test to how dots arrive.

How to allowlist dots in your CDN

These steps come from OpenAI's Cloud browser allowlisting guide. In every case the provider verifies the signatures for you.

Cloudflare

Cloudflare recognises the traffic as a signed agent with bot tag chatgpt-agent and detection ID 129220581. In the dashboard, open Security, then WAF, and create a custom rule with the expression "Bot Detection ID equals". Search for ChatGPT Operator, select ID 129220581, and set the action to allow or skip. The Cloudflare Radar entry for ChatGPT agent shows the same entry.

Akamai

Akamai lists the traffic under the existing bot name ChatGPT Agent in its Artificial Intelligence bots category. Create a custom bot category in your security policy, add the Akamai-defined bot ChatGPT Agent, and set the category action to Allow.

HUMAN

In HUMAN Sightline, go to Policies, Traffic Policy Settings, Known bots and Crawlers, search for ChatGPT Agent, and set it to allow. HUMAN AgenticTrust also lets you manage permissions for the same entry.

Vercel

If your site is on Vercel, OpenAI says "no additional configuration is required". Vercel identifies the traffic as ChatGPT Agent (chatgpt-operator) and verifies it automatically.

Any other CDN or your own server

OpenAI's guide gives four steps: confirm the Signature-Agent header exactly matches "https://chatgpt.com" with the quotes, fetch the public key from the directory, verify the Signature and Signature-Input headers according to RFC 9421, and allow requests only after the signature checks out.

How to block or limit dots

If you need to keep agents away from some or all of your site, use the same verified identity in reverse.

• Cloudflare: a WAF custom rule on Bot Detection ID 129220581 with the action Block or Managed Challenge. Add a path condition to limit it to, say, /checkout/.
• Akamai and HUMAN: set the ChatGPT Agent entry to deny or challenge instead of allow.
• Your own server: verify the signature, then return 403 for requests from the chatgpt.com key directory on the paths you want to protect.

Blocking by user agent does not work, because the Cloud browser sends a normal Chrome string. Blocking all OpenAI IP ranges is too blunt: it can catch ChatGPT-User and OAI-SearchBot, and it misses dots that a user routes through their own laptop.

What about robots.txt? OpenAI documents robots.txt control for GPTBot and OAI-SearchBot, not for the Cloud browser. A dot acts for one person in real time, like ChatGPT-User, so treat robots.txt as the wrong tool for this job.

How to make your site work well for dots

Allowing dots is step one. Making sure they can finish the job is where the value is. The fixes are the same ones that help Meta Muse, Grok Bot and people using screen readers.

1. Keep human checks on actions, not pages. A CAPTCHA on a search box stops research. The same CAPTCHA on account creation stops abuse.
2. Put key facts in text. Prices, stock, delivery times, opening hours and service areas should be in the HTML, not only in images or slow widgets. Back them with structured data.
3. Support saved cards and guest checkout. OpenAI says dots "can make purchases using cards you've already saved on a merchant's website". If your checkout forces a new account every time, the dot has to hand the job back.
4. Make sign-in standard. Dots support secure sign-in on "supported websites". Normal username and password forms with standard field names work best. Unusual multi-step widgets are more likely to need the user.
5. Write clear errors. "Postcode not recognised, try without spaces" lets an agent fix a mistake. A red border with no text does not.
6. Offer an API or connector if you have one. Dots work through plugins as well as the browser. A documented API can be a faster, more reliable path. See MCP and APIs for agents.

Three examples

These are illustrative scenarios based on the problems we see most often in site audits, not named client cases.

A print supplier with a trade portal

A design agency asked its dot to "download last month's invoices from all our suppliers". At one printer, the dot reached the login page and stopped: the portal sat behind a firewall rule that challenged all cloud traffic. The printer added a Cloudflare allow rule for Bot Detection ID 129220581 on the portal path only. The agency's dot now signs in with the agency's own saved login, downloads the PDFs, and hands any two-factor step back to the office manager.

A physiotherapy clinic

The clinic's booking page loaded available slots through a third-party widget that needed several seconds of scripts, and its contact form had a CAPTCHA. Patients who asked their dot to "book a sports massage next Tuesday evening" got a message that the slots could not be read. The clinic added the next two weeks of slots to the page as text, linked to the widget for the final step, and moved the CAPTCHA to a risk-based mode. Bookings from agents began to arrive with complete details.

An electronics retailer during a launch

The retailer welcomes agents most of the year. For a one-day console launch it added a managed challenge for verified agents on the cart and checkout paths, and removed it the next morning. Product and stock pages stayed open, so dots could still tell their users when stock returned.

Common questions

Do dots affect my SEO?

No. Dots are not a search crawler and do not influence Google or Bing rankings. If you want to appear in ChatGPT's search answers, that depends on OAI-SearchBot, which is a separate decision.

Does OpenAI train on pages a dot visits?

OpenAI's documentation on dots talks about user content and settings, not about third-party pages a dot reads during a task. For training on your public content, the documented control is GPTBot in robots.txt.

Will dots overload my server?

A dot works on one person's task at a time and loads pages like a browser does, so per-user volume is low. If many users send dots to the same page at once, for example a product launch, your normal rate limits apply. Use them on actions, and allow reasonable browsing.

Can I tell a personal dot from a specialist dot?

Not from public headers today. Both use the ChatGPT Cloud browser identity. Specialist dots have their own identity and credentials inside an organisation's systems, which you would see as a named account on your site if they sign in.

How does this compare with Meta Muse and Grok Bot?

All three run on their own cloud computers. Muse has a muse- token listed by Cloudflare, Grok Bot is listed as GrokAgent, and dots rely on the ChatGPT signature with no token. See our personal AI agents guide for the full comparison and our Meta Muse guide for the Meta side.

Your dots checklist

• □Open your CDN's bot analytics and filter for ChatGPT Agent to see current dots and Cloud browser traffic.
• □If you run your own server, log the Signature-Agent header so signed agents become visible.
• □Check that proxies and load balancers pass Signature, Signature-Input and Signature-Agent through unchanged.
• □Decide per area: browse, book, buy, account. Allow the verified identity where agents help customers.
• □Move CAPTCHAs from browsing pages to the actions that need them.
• □Put prices, stock and hours in plain HTML with matching structured data.
• □Support guest checkout or saved cards, and standard sign-in forms.
• □Re-test key pages with the AI Agent Readiness Check after each change.

For the named agents that do send a token, such as Muse, Grok Bot and Hark, use the AI agent log checker. For everything else we track, see the AI and LLM bot directory.