Join our daily and weekly newsletters for the latest updates and exclusive content on industry-leading AI coverage. Learn More
It was a big week for AI announcements following events from Microsoft, Google, and Anthropic. But OpenAI is finishing things out with news of its own. And no, we’re not just talking about its $6.5 billion acquisition of Jony Ive’s design team to lead a new hardware effort, “io” at OpenAI.
Today, the company upgraded its Operator autonomous web browsing and cursor controlling agent within ChatGPT from using the prior GPT-4o multimodal large language model to the newer and more powerful o3 reasoning model.
The update, released globally today, May 23, 2025, is available as a “research preview” to paying subscribers of OpenAI’s $200 USD-monthly ChatGPT Pro plan.
Basically, that is OpenAI’s way of saying it’s not a fully “sanded down” or perfected product yet — it may still have kinks and issues.
But with rival Google offering its own top tier AI subscription bundle for a price of nearly $250 USD regularly (currently running a discount down to $125 for the first three months) to access its latest Gemini multimodal, Imagen image generation, and Veo video generation models, suddenly OpenAI’s ChatGPT Pro plan seems more affordable by comparison.
What is OpenAI’s Operator and what is it for?
Operator first debuted in January 2025 as OpenAI’s initial step into semi-autonomous agents, specifically Computer Using Agents (CUAs). The idea is to go beyond the chatbot interface of ChatGPT and allow OpenAI’s powerful AI models to start taking more actions on behalf of the user.
Thus, Operator was designed to autonomously point, click, scroll, and type to complete web-based tasks such as booking dinner reservations, compiling shopping lists, or ordering event tickets. This agentic capability allows it to complete user tasks directly through a browser interface, from booking reservations to gathering online data.
For safety, privacy and security purposes, Operator didn’t use any existing web browser on a user’s PC or Mac. Instead, it ran in a cloud-hosted virtual browser accessible via a standalone site—operator.chatgpt.com—where users could input requests and observe the agent perform tasks in real time.
It combined vision, reasoning, and interaction capabilities based on GPT-4o, marking a new direction for OpenAI in agentic AI.
The product was launched as a research preview for ChatGPT Pro subscribers and featured built-in safety measures like user confirmations, Watch Mode, and restrictions on high-risk web platforms.
It was also being tested in enterprise contexts, including travel planning and civic services, demonstrating its potential across both consumer and business environments.
o3 offers improved accuracy, structure, and success rates
With this update, OpenAI aims to enhance performance across several key dimensions. The new o3-based Operator demonstrates improved persistence and accuracy during browser interactions.
In practical terms, this means it is more likely to complete user tasks successfully and with less need for correction or repetition. Moreover, users can expect responses that are clearer, more structured, and more comprehensive.
In comparative evaluations, the new model shows a distinct preference advantage over its predecessor. Human preference studies reveal that users favor the o3 model for its style, comprehensiveness, and clarity. It also performs strongly in instruction following and efficiency, though results for factual correctness are more balanced between versions.
Performance on third-party evaluation benchmarks reflects these enhancements. On the OSWorld benchmark that measures completion of browser-based tasks, the o3 model scores 42.9 compared to 38.1 for the previous version.
However, OpenAI notes that due to limitations in the automated grading system, the actual performance gain could be closer to 20 percentage points!
On WebArena, the new model achieved a score of 62.9, up from 48.1. The most dramatic improvement appears on the GAIA benchmark, where the o3 model scores 62.2, vastly surpassing the prior model’s 12.3.
Side-by-side task comparisons further illustrate these gains. In one example involving a restaurant booking request, the new model provided a clearer and more detailed list of available reservations, including locations, Michelin ratings, and seating notes, presented in a well-formatted table. The previous version, while functional, delivered less information in a less organized manner, according to an image included with the new o3 Operator release notes:
Safeguards remain, as do general cautionary notes about usage on sensitive, financial transactions and account access
The o3 model also inherits the safety measures introduced with earlier versions, with further fine-tuning for its role as an agentic system.
OpenAI has integrated enhanced training against harmful task execution, prompt injection vulnerabilities, and mistakes involving user intent.
Evaluations show that the model now confirms 94% of sensitive actions before executing them, with 100% confirmation in financial transactions. Prompt injection susceptibility has also decreased from 23% to 20%.
Notably, the o3 Operator maintains a cautious boundary on certain high-risk web interactions, such as email or financial platforms, where it may require user supervision via Watch Mode or explicitly refuse to proceed. These measures are part of a layered approach to safety that combines model-level robustness with real-time monitoring.
While the upgrade to Operator marks a technical improvement, it also reflects OpenAI’s ongoing commitment to responsible AI deployment.
The system’s ability to take real-world actions introduces new risks, and the development team continues to refine its safety protocols accordingly.
According to OpenAI’s updated o3 system card documentation, the model remains below high-risk capability thresholds in categories such as biological and chemical misuse and has no native coding environment or terminal access, further reducing potential misuse vectors.
Operator remains a research preview and is accessible only to ChatGPT Pro users. The Responses API version of Operator will continue to be based on the GPT-4o model, at least for now.
Implications for enterprise technical decision-makers
The upgraded Operator stands to significantly enhance the workflows of professionals in AI engineering, orchestration, data management, and IT security.
For those building or maintaining machine learning models, the model’s improved accuracy and structured outputs reduce the overhead of test validation and troubleshooting.
In orchestration contexts, it offers a practical, reliable tool for automating browser-based components of complex pipelines.
Data engineers can delegate manual web interactions—such as data verification and scraping—with more confidence, freeing time for higher-level optimization work.
Security professionals, meanwhile, gain a safer way to simulate user behavior in audits and incident response exercises, thanks to the model’s layered safety mechanisms.
Across these disciplines, the o3-based Operator introduces both a capability upgrade and a risk mitigation framework, making it a practical addition to the modern technical toolkit.
