Prompting ChatGPT Agent Mode (Tasks and Guardrails)

TL;DR: ChatGPT agent prompts fail two ways: no stop condition, so the run never ends cleanly, and no scope limit, so it touches more than you meant. Agent mode adds real guardrails, including watch mode, takeover mode, and required confirmations, but OpenAI's own help pages are mid-transition toward ChatGPT Work as of September 2026, so confirm which surface you actually have before you write the prompt.

Most people write an agent-mode prompt the same way they write a chat prompt: state the goal, hit send, watch what happens. That works when the worst-case output is a bad paragraph you can just ignore. It stops working the moment the model can also click a button, submit a form, or send an email on your behalf, because now the worst case is an action, not a sentence.

This is a practical guide to writing ChatGPT agent prompts that hold up under that difference: what the mode actually does, which guardrails OpenAI built in for you, which ones you still have to write yourself, and how task gets used to mean two different things depending on which part of ChatGPT you are in.

What is ChatGPT agent mode, and how do you start it?

Agent mode is the setting inside ChatGPT that lets the model act on a task across many steps, using its own virtual computer, instead of producing one reply and stopping. You turn it on from the tools menu in the composer, or by typing a slash command. OpenAI's help center describes the mechanics plainly: "To start using agent mode, select it from the tools menu or type /agent in the composer." From there, you write one instruction and the model takes over: "Describe the task you want completed, and the agent will begin executing it. It will pause for clarification or confirmation when needed."

Under the hood, that virtual computer is a real toolkit, not a metaphor. OpenAI's original announcement describes equipping the model with "a suite of tools: a visual browser that interacts with the web through a graphical-user interface, a text-based browser for simpler reasoning-based web queries, a terminal, and direct API access." It can also draw on whatever apps you have connected, Gmail or GitHub for example, treating them as another source of information for the task rather than something you have to check by hand yourself.

None of this arrived fully formed. Agent mode launched on July 17, 2025, and it replaced two separate products rather than adding a third. OpenAI's release notes describe it simply: "ChatGPT agent allows ChatGPT to complete complex online tasks on your behalf." At launch, it was available "for users on Pro, Plus, and Team plans." It absorbed the older Operator tool's browsing ability and deep research's analysis skill into one conversation. The release notes are direct about it: "With ChatGPT agent’s built-in virtual browser, the core functionality of Operator has been integrated. The standalone Operator experience at operator.chatgpt.com will be deprecated in the coming weeks." The current help page confirms that happened: "Operator functionality is now integrated into ChatGPT agent mode. The Operator website is no longer accessible."

Is ChatGPT agent even the right name anymore?

As of early September 2026, it genuinely depends which OpenAI page you land on, and that is worth settling before you write a single prompt.

The original July 2025 launch post now carries its own note pointing away from itself: "This launch post is outdated." It directs readers instead toward newer product pages. Meanwhile, OpenAI's newer "ChatGPT Work and Codex" help article describes a genuinely different structure: ChatGPT split into Chat, Work, and Codex. "Work is an agent designed for longer, multi-step work and finished deliverables." That article's own rollout note adds: "ChatGPT Work is gradually rolling out to eligible accounts over the coming days."

So what does this mean for a prompt you write today? Practically, not much, because the mechanics below, the tools menu entry point, the /agent command, watch mode, takeover mode, the confirmation and refusal behavior, are all still documented in the present tense on OpenAI's own agent-mode page. Work's own description of itself describes the same underlying pattern under a different name: "You can review progress, answer questions, change direction, and approve important actions." Treat agent mode and Work as the same discipline wearing two labels mid-rename, and verify which one your account actually shows before you rely on a specific menu path.

Which plans get agent mode, and how many tasks can you run?

Agent mode is a paid feature with a hard monthly ceiling, and the ceiling is generous enough that most individual users will hit a different limit first, like their own attention span.

Two details in that table matter more than the raw numbers. First, the count is generous about back-and-forth: "Only initial user-initiated agent requests count toward the limit. Intermediate clarifications or authentication steps are not counted against the usage limit." Logging in mid-task, or answering a clarifying question, does not burn a second message. Second, the 400-per-month figure for Pro is not new inflation, it matches what OpenAI published at launch in July 2025: "Pro users have 400 messages per month, while other paid users get 40 messages monthly, with additional usage available via flexible credit-based options." The ceiling has held for over a year, which is one of the more stable facts in this whole space.

The Free-plan answer is worth stating explicitly because it is easy to assume otherwise: "Agent mode is currently only available for paid plans."

Why should your prompt name a stop condition, not just a goal?

Because a goal is directional and a stop condition is checkable, and only one of those tells an autonomous run when to quit. "Research competitors and summarize what you find" has no finish line the model can recognize; it can always read one more page. "Stop once you have identified five direct competitors with public pricing, or after 20 minutes, whichever comes first" has a finish line a stranger could verify without having watched the run.

This is not unique to ChatGPT, it is true of any agent that loops on its own, and it is the whole argument behind our companion piece on agent prompt structure across coding tools, AI Agent Prompt Templates (Autonomous Workflows). What is specific to ChatGPT's agent mode is that OpenAI already tells you, in plain language, what a badly-scoped prompt looks like: "Avoid vague, open-ended prompts like “Check my email and handle everything.”" That sentence is doing the same job as a stopping condition, just phrased as a warning instead of a template.

A stop condition you can write into almost any agent-mode prompt has three parts: a definition of done that does not depend on judgment calls, a maximum step or time budget, and an instruction for what to do when it cannot finish cleanly.

TASK: Find three vendors that can fulfill [requirement], each with a public
price and a support contact.

DONE means: exactly three vendors listed, each with a link to a public price
page and a named support channel. Stop the moment you have three that qualify,
do not keep searching for a fourth "just in case."

BUDGET: If you have not found three qualifying vendors after checking 10
sources, stop and report what you found instead of continuing indefinitely.

IF BLOCKED: If a site requires a login you do not have, note it and move on
rather than guessing credentials or trying to work around it.

How do you scope what the agent is allowed to touch?

By naming what it can use before it starts, not by hoping it infers a sensible boundary from the goal alone. Agent mode can read from any app you have connected, and OpenAI's own guidance treats that as a real risk surface rather than a convenience to enable by default: "You should use extra caution when using apps with ChatGPT agent to prevent unauthorized access to sensitive information." One of OpenAI's own documented best practices reads simply: "Enable only the apps needed for the current task." That is a scope limit applied at the account level before the prompt is even written.

Scope also has a network dimension you do not control from the prompt at all. OpenAI maintains a website blocklist that applies "across both the virtual browser and connectors." If the agent attempts a restricted site, "the task will not proceed for that source." Workspace admins on Enterprise and Edu plans can extend this list to specific domains for their organization. None of that is prompt engineering, it is closer to firewall configuration, but it is worth knowing it exists so you do not spend a prompt trying to forbid something the platform already forbids for you.

Inside the prompt itself, the scope section is where you say what the agent must not touch even if it seems related: which folders, which apps, which categories of action (purchases, deletions, anything sent externally) require you to step back in. That list is specific to your task, but the habit is the same one this site has documented for red-teaming a prompt before you trust the output: write down what you did not intend to permit, before a run finds the gap for you.

What guardrails fire automatically, and what do you still have to prompt for?

OpenAI built several safeguards into agent mode itself, and they fire regardless of what your prompt says, which is exactly the point: "ChatGPT agent incorporates multiple safeguards, including user confirmations for high-impact actions, refusal patterns for disallowed tasks, prompt injection monitoring, and a “watch mode” requiring user supervision on certain sites." Three of those are worth knowing individually, because they trigger in different situations.

Confirmation before consequential actions. At launch, OpenAI described the standing principle this way: "Most importantly, you’re always in control. ChatGPT requests permission before taking actions of consequence, and you can easily interrupt, take over the browser, or stop tasks at any point." The same launch post breaks this into three named mechanisms. First: "Explicit user confirmation: ChatGPT is trained to explicitly ask for your permission before taking actions with real-world consequences, like making a purchase." Second: "Active supervision (“Watch Mode”): Certain critical tasks, like sending emails, require your active oversight." Third: "Proactive risk mitigation: ChatGPT is trained to actively refuse high-risk tasks such as bank transfers." The current help page still describes the same three-part shape, just with watch mode written in lowercase rather than capitalized, one small sign of how much this surface has been edited since 2025.

Takeover mode for logins. If a task hits a page that needs credentials, agent mode pauses and asks you to take the wheel: "If a task requires a login, ChatGPT agent will pause and prompt you to take control of the virtual browser". While you are the one typing, the model is not watching: OpenAI states that during that window, "screenshots are not captured, which helps protect passwords and other sensitive data you enter." That is also the documented answer to whether you should ever type a password directly into a message: no, use takeover mode for it instead, because that is the path OpenAI built specifically so the model never sees the credential at all.

Prompt injection defenses that reduce risk without removing it. This is the guardrail your own prompt cannot fully substitute for, because the threat lives on the page the agent reads, not in your instructions. OpenAI's worked example is concrete: you ask the agent to plan a group dinner by checking your calendar and recent emails, and somewhere in that research it runs into a manipulated comment quietly instructing it to pull a password-reset code out of Gmail and forward it to an attacker's site. The defense stack is monitoring plus training plus the confirmation and refusal behavior above, and OpenAI is explicit that this reduces rather than eliminates the risk: "These measures are designed to help prevent harmful or unintended outcomes. However, these measures don’t eliminate all risks." If you want the fuller mechanics of this attack class outside ChatGPT specifically, our prompt injection guide covers how it shows up across tools, not just this one.

What does a fully guarded agent-mode prompt look like?

It states the goal once, then spends more words on the conditions around it than on the goal itself, because the conditions are what a chat prompt never needed and an autonomous run cannot function without.

GOAL: Update our vendor comparison spreadsheet with current public pricing
for the six tools listed in the "Vendors" sheet.

SCOPE: Only read the public pricing pages linked in column B. Do not log
into any vendor account, do not visit any site not linked in that column,
and do not edit any sheet other than "Vendors".

DONE: Every row in "Vendors" has a filled "Current Price" and "Checked On"
cell, sourced from that vendor's own page. Stop as soon as all six rows
are filled, do not re-check rows that are already done.

IF BLOCKED: If a price requires a login or a sales quote, write "requires
contact" in the price cell and move to the next row instead of guessing
a number or trying to log in.

OUTPUT: A one-line summary at the end: how many rows updated, how many
marked "requires contact", and a link to the spreadsheet. Nothing else.

Notice what is missing: nowhere does this prompt tell the model to be careful. Every one of OpenAI's built-in guardrails, confirmation on a purchase, a pause at any login page, refusal of anything resembling a bank transfer, still applies underneath this prompt without being asked for. What the prompt adds is the part only you know: which six rows, which sheet, what done means for this specific spreadsheet, and what to do the moment reality does not match the plan.

Is a task a single run, or the recurring Scheduled Tasks feature?

Both, and mixing them up is exactly how a scope you wrote for a five-minute run ends up governing something that repeats every Monday morning unattended.

A single agent-mode task is what everything above describes: one instruction, one run, a human present to answer a clarification or step through a takeover. But agent mode also supports recurring runs directly: "After a task finishes, you can set it to repeat daily, weekly, or monthly by clicking the Clock icon." These are managed centrally at chatgpt.com/schedules, and each recurrence still counts against your monthly limit, per OpenAI's own note: "each unique agent invocation will count against the monthly message limit. This includes agent requests that are part of scheduled tasks."

Separately, the newer Work surface documents its own scheduling layer that goes further than a repeat interval, adding triggers: "Work can also run once, repeat on a schedule or trigger, or monitor for changes through Scheduled Tasks." It also supports event-triggered runs: "Eligible Plus, Pro, Business, Enterprise, Edu, and ChatGPT for Healthcare users can ask Work to run an event-triggered (webhook-based) task when a supported event occurs in a connected app. Supported events include new Gmail messages, new Slack channel messages, and GitHub pull request activity in an authorized repository." That is a materially bigger surface than a simple weekly repeat, because now the trigger is somebody else's action, not your own clock.

The practical rule: tighten whatever scope and stop condition you would tolerate as loose for a one-off, watched run before you let the same prompt fire on a schedule or a webhook, because nobody is there to notice it went sideways.

What do you do if a run looks wrong halfway through?

Stop it, do not wait to see if it self-corrects. OpenAI's own guidance is unambiguous on this one: "Stop tasks immediately if something seems suspicious." You can interrupt or take over at any point, and the documented cleanup step afterward is to clear the session rather than assume it is fine: "Clear remote browser data after sensitive sessions."

A few habits make this easier in practice. Read the on-screen narration as the task runs instead of tabbing away and checking back at the end, since the summary you get afterward is written by the same system you are trying to supervise. If a task needed a login, log out of that site and clear cookies once you are done rather than leaving the session live for next time. And if you are ever unsure whether an app needs to stay connected between tasks, disable it and reconnect it next time you need it. None of this is exotic. It is the same discipline this site recommends once you are past the basics of ChatGPT prompting: watch the intermediate state a run produces, not just the summary it hands you at the end.