At DevDay on 29 September 2026 OpenAI paired always-on Dots agents — each with its own cloud computer, browser and thousands of connectors — with ChatGPT Space, where employees, ChatGPT, Codex and those agents work from one shared context. The permission model people will reason about is per-connector OAuth scope. The boundary that decides what happens is who may write into the context, and nobody is enforcing that one.
A human approves a $40 refund and the runtime executes something else — no injection, no sandbox escape, just an approval stored as a boolean against an identifier while the arguments stayed writable. Loopjacking reproduced it across seven Agno releases; one SDK in the sample rejected it, and the difference is three lines of design.
Everyone predicted a bought ranking; OpenAI bought the conversation instead, and that is the better design — for exactly as long as the two conversations stay apart. Sponsored Agents put an advertiser-operated agent behind a labelled ad slot and keep it out of the assistant's answer. But the separation is a property of the session, and what actually moves between the two lanes is claims, carried by the person, with no field anywhere saying a paid party said it first.
All four render a streaming message list, and the demo looks the same in each. What differs is the layer you cannot swap later — a wire protocol, an npm dependency, a source tree copied into your repo, or a whole Python server whose front end you never wrote — and after a year in which one canvas archived itself and another changed hands, "what do I still own if this goes quiet" is the axis worth deciding on.