Simon Willison 深度拆解 ChatGPT
Understanding ChatGPT Work
做 AI 产品与 Agent 的同学必看，这篇把 ChatGPT Work 的云版/本地版差异、模型选择、联网代码执行、无头浏览器等关键能力一次讲透，还点出了提示注入风险，建议直接收藏对照你的使用场景。
OpenAI announced ChatGPT Work on July 9th, and have been furiously iterating on it ever since. It is an extraordinarily confusing and very powerful product. Here's what I've figured out about it so far.
OpenAI 于7月9日发布了 ChatGPT Work，并自此对其进行了快速迭代。这是一个极其令人困惑但又非常强大的产品。以下是我目前对它的理解。
ChatGPT Work is actually two products
ChatGPT Work 实际上是两个产品
The more interesting version of ChatGPT Work is the one that runs in the cloud. This can be accessed via chatgpt.com or through the ChatGPT mobile apps. Let's call it Work Cloud.
ChatGPT Work 更有趣的版本是运行在云端的那个。可以通过 chatgpt.com 或 ChatGPT 移动应用访问。我们称之为 Work Cloud。
If you install the ChatGPT desktop app - the app that used to be called Codex - you gain access to a thing called ChatGPT Work that can access files and run programs directly on your computer. Let's call that one Work Local. This one feels more like regular Codex re-skinned to be less intimidating to non-software-developers.
如果你安装了 ChatGPT 桌面应用——即之前被称为 Codex 的应用——你就能访问一个名为 ChatGPT Work 的功能，它可以访问文件并直接在你的电脑上运行程序。我们称之为 Work Local。这个版本感觉更像是普通 Codex 的重新包装，使其对非软件开发人员不那么令人生畏。
For the rest of this article I'm going to talk exclusively about Work Cloud.
在本文的其余部分，我将专门讨论 Work Cloud。
Work is for paid subscribers only
Work 仅限付费订阅用户使用
Right now, ChatGPT Work (in both flavors) is available only to $20/month and up subscribers. Free users and $8/month Go users do not have access.
目前，ChatGPT Work（两种版本）仅对每月20美元及以上的订阅用户开放。免费用户和每月8美元的 Go 用户无法访问。
Work has features that aren't available in Chat
Work 具有 Chat 中没有的功能
The interface for accessing Work is a tab selector, which presents it as an alternative to Chat:
访问 Work 的界面是一个标签选择器，将其作为 Chat 的替代选项呈现：
The obvious question is when should I use Chat, and when should I use Work?
显而易见的问题是，何时应该使用 Chat，何时应该使用 Work？
OpenAI's official answer to that question is:
OpenAI 对此问题的官方回答是：
Use Chat when you want an answer, explanation, brainstorm, or short draft. Use ChatGPT Work when you want ChatGPT to complete a task with a clear outcome, such as a brief, deck, analysis, recurring update, workflow, or file you can review and use.
当你想要一个答案、解释、头脑风暴或简短草稿时，使用 Chat。当你希望 ChatGPT 完成一个具有明确结果的任务时，例如简报、演示文稿、分析、定期更新、工作流程或你可以审阅和使用的文件，请使用 ChatGPT Work。
I find that almost entirely useless, because I've been using regular ChatGPT Chat for all of those task categories for years!
我发现这几乎毫无用处，因为多年来我一直在使用常规的 ChatGPT Chat 来完成所有这些任务类别！
The better question then is what features does Work have that are missing from Chat?
那么更好的问题是，Work 有哪些 Chat 所没有的功能？
After extensive experimentation I think I've mostly figured that out:
经过大量实验，我认为我大致弄清楚了：
- Options to use Luna and Terra in place of Sol
- A code execution environment with Internet access
- A headless Chrome browser
- A persistent filesystem shared between sessions
- The ability to publish ChatGPT Sites
- The ability to run sub-agent sessions with Sol, Luna, and Terra
- Scheduled prompt automations
- 可以选择使用 Luna 和 Terra 替代 Sol
- 具有互联网访问权限的代码执行环境
- 无头 Chrome 浏览器
- 会话之间共享的持久文件系统
- 发布 ChatGPT 网站的能力
- 使用 Sol、Luna 和 Terra 运行子代理会话的能力
- 定时提示自动化
Model selection
模型选择
In Work, you get the option to pick GPT-5.6 Sol, Luna, or Terra, each with Light, Medium, High, Extra High, Max, or Ultra reasoning levels. You can also pick GPT-5.5 at Light, Medium, High, or Extra High.
在 Work 中，你可以选择 GPT-5.6 Sol、Luna 或 Terra，每个都有 Light、Medium、High、Extra High、Max 或 Ultra 推理级别。你还可以选择 GPT-5.5，级别为 Light、Medium、High 或 Extra High。
These look to be the same models that are available through the OpenAI API.
这些看起来与通过 OpenAI API 可用的模型相同。
Chat offers a different selection: 5.6 Instant, Medium, High, Extra High, and Pro. It doesn't explain if those are Luna or Terra or Sol (I'm assuming Sol?). 5.6 Pro appears to be exclusive to Chat, with no equivalent in Work.
Chat 提供了不同的选择：5.6 Instant、Medium、High、Extra High 和 Pro。它没有说明这些是 Luna、Terra 还是 Sol（我猜是 Sol？）。5.6 Pro 似乎是 Chat 独有的，在 Work 中没有对应版本。
My current understanding from using Codex is that Ultra is a special mode that more eagerly delegates to sub-agents.
根据我使用 Codex 的经验，我目前的理解是，Ultra 是一种特殊模式，它更积极地委派给子代理。
I believe ChatGPT Work sessions are billed against your Codex allowance, while ChatGPT Chat Sessions get their own, separate allowance. This may help explain the model availability differences.
我相信 ChatGPT Work 会话按你的 Codex 配额计费，而 ChatGPT Chat 会话则有自己独立的配额。这可能有助于解释模型可用性的差异。
Code execution with Internet access!
带互联网访问的代码执行！
As a long-time fan of the Code Interpreter pattern - pioneered by OpenAI in 2023 - this is by far the most exciting feature of ChatGPT Work (Cloud) for me.
作为代码解释器模式的长期粉丝——该模式由 OpenAI 于 2023 年首创——这对我来说是 ChatGPT Work（Cloud）最令人兴奋的功能。
The code execution environment can now talk to the rest of the internet!
代码执行环境现在可以与互联网的其他部分通信！
ChatGPT Chat can't do this - if you ask it to install additional software packages or interact with websites or APIs that access will be blocked by the container proxy.
ChatGPT Chat 无法做到这一点——如果你要求它安装额外的软件包或与网站或 API 交互，该访问将被容器代理阻止。
(Weirdly, back in January it grew the ability to install packages, but that doesn't seem to work any more. I wish they had better changelogs!)
（奇怪的是，在一月份它曾获得安装软件包的能力，但现在似乎不再起作用了。我希望他们有更好的变更日志！）
Claude's equivalent container has allowed restricted internet access since it launched last September. Claude can install packages from PYPI and NPM and clone repositories from GitHub. But that is about it: the allowlist of domains is very short.
Claude 的等效容器自去年九月推出以来，已允许受限的互联网访问。Claude 可以从 PYPI 和 NPM 安装软件包，并从 GitHub 克隆仓库。但仅此而已：允许的域名列表非常短。
ChatGPT Work allows a whole lot more than that. It can be configured with a specific list of allowed domains, but the default appears to be open to all.
ChatGPT Work 允许的远不止这些。它可以配置为特定的允许域名列表，但默认似乎是开放给所有域名的。
This makes Work an incredibly useful tool. You can have it clone GitHub repositories, install their dependencies, then use them to interact with the rest of the web!
这使得 Work 成为一个极其有用的工具。你可以让它克隆 GitHub 仓库，安装它们的依赖项，然后使用它们与网络的其他部分交互！
A full, headless Chrome browser
一个完整的无头 Chrome 浏览器
Another killer feature of ChatGPT Work is the browser tool. ChatGPT Work can launch a full Chrome instance, load websites, fill out forms, and take screenshots.
ChatGPT Work 的另一个杀手级功能是浏览器工具。ChatGPT Work 可以启动一个完整的 Chrome 实例，加载网站，填写表单，并截取屏幕截图。
It can even run JavaScript against the DOM of those pages. I prompted:
它甚至可以对那些页面的 DOM 运行 JavaScript。我提示：
Load simonwillison.net in your browser and extract the headings using JavaScript
在你的浏览器中加载 simonwillison.net，并使用 JavaScript 提取标题
ChatGPT Work fire up a browser instance and ran the code:
ChatGPT Work 启动了一个浏览器实例并运行了代码：
await tab.playwright.evaluate(() => {
return Array.from(document.querySelectorAll("h1,h2,h3,h4,h5,h6"), heading => ({
level: heading.tagName.toLowerCase(),
text: heading.innerText.trim().replace(/\s+/g, " "),
id: heading.id || null
}));
});await tab.playwright.evaluate(() => {
return Array.from(document.querySelectorAll("h1,h2,h3,h4,h5,h6"), heading => ({
level: heading.tagName.toLowerCase(),
text: heading.innerText.trim().replace(/\s+/g, " "),
id: heading.id || null
}));
});This feels a lot like my shot-scraper javascript tool, only now I can access it on my phone!
这感觉很像我的 shot-scraper javascript 工具，只是现在我可以在手机上访问它！
A persistent, shared filesystem
一个持久化的、共享的文件系统
ChatGPT Chat gets a fresh filesystem for each chat session. These cannot be accessed from any other session.
ChatGPT Chat 为每个聊天会话提供一个新的文件系统。这些文件系统无法从任何其他会话访问。
In ChatGPT Work each session gets its own scratch folder - named something like /workspace/scratch/e00a0a017944 - but each of those are persisted across sessions, so you can access files from previous chats. I have 171 folders in /workspace/scratch right now!
在ChatGPT Work中，每个会话都有自己的临时文件夹——命名类似/workspace/scratch/e00a0a017944——但这些文件夹在会话间持久保留，因此你可以访问之前聊天中的文件。目前我在/workspace/scratch下有171个文件夹！
As far as I can tell that /workspace volume is mounted to all Work sessions that are currently running - file edits from one can be instantly seen by the others. They don't seem to share the same process space though, and localhost servers running in one can't be accessed from another.
据我所知，/workspace卷挂载到了所有当前运行的Work会话——一个会话中的文件编辑可以被其他会话立即看到。不过它们似乎不共享进程空间，一个会话中运行的localhost服务器无法从另一个会话访问。
ChatGPT Sites
ChatGPT网站
ChatGPT Work has the ability to build and deploy entire websites, using Cloudflare Workers. These can have HTML and JavaScript and can run server-side features too, including stateful features on top of Cloudflare D1 and R2.
ChatGPT Work能够使用Cloudflare Workers构建和部署整个网站。这些网站可以包含HTML和JavaScript，并且可以运行服务器端功能，包括基于Cloudflare D1和R2的有状态功能。
Here's a simple site I built with this feature:
以下是我用此功能构建的一个简单网站：
london-pelicans-in-her-piety.simonw.chatgpt.site
london-pelicans-in-her-piety.simonw.chatgpt.site
My prompt was:
我的提示词是：
Figure out all of the places in London with a pelican in her piety, then turn that into a JSON file and build a ChatGPT sites site about them
找出伦敦所有有“鹈鹕虔诚”图案的地方，然后将其转换为JSON文件，并构建一个关于它们的ChatGPT网站。
(A pelican in her piety is a fascinating piece of medieval Christian imagery - once you know about them you'll find them all over the place.)
（“鹈鹕虔诚”是中世纪基督教图像中一个迷人的元素——一旦你了解了它们，你会发现它们无处不在。）
These sites default to being private to the user that created them, but you can make them public and (on team plans) share them with other specific individuals.
这些网站默认对创建它们的用户私有，但你可以将其设为公开，并且（在团队计划中）可以与其他特定个人共享。
Sub-agents with Sol, Luna, and Terra
子代理与Sol、Luna和Terra
There's not much to say about this one. ChatGPT Chat can't run sub-agents. ChatGPT Work can. This is very much a power-user feature: if you are running a complex project that can benefit from multiple parallel agents working together, Work can do that.
关于这一点没什么好说的。ChatGPT Chat无法运行子代理。ChatGPT Work可以。这非常符合高级用户功能：如果你正在运行一个可以从多个并行代理协作中受益的复杂项目，Work可以做到。
Scheduled prompt automations
定时提示自动化
Another feature that seems to have migrated from regular ChatGPT to ChatGPT Work at some point. You can prompt ChatGPT Work like this:
另一个似乎从普通ChatGPT迁移到ChatGPT Work的功能。你可以这样提示ChatGPT Work：
run a search to see if Waymo have announced a launch date for Half Moon Bay every day at 8am
每天上午8点运行搜索，查看Waymo是否宣布了半月湾的发布日期。
This will schedule a prompt to run on that frequency. These prompts can decide that nothing interesting has happened, or they can decide to notify you of some new information.
这将安排一个提示按该频率运行。这些提示可以决定没有发生有趣的事情，或者决定通知你一些新信息。
Is this safe?
这安全吗？
An open question for me right now is how safe all of this stuff is.
目前对我来说一个悬而未决的问题是所有这些事情的安全性如何。
My lethal trifecta model warns about the risks inherent in any agent system that combines access to private data with exposure to untrusted content and a way to communicate stolen information back to an attacker.
我的“致命三重奏”模型警告了任何结合了访问私有数据、接触不可信内容以及将窃取信息传回攻击者的方式的代理系统固有的风险。
ChatGPT Work combines all three!
ChatGPT Work结合了这三者！
I'd love to hear more from OpenAI about how they protect ChatGPT Work sessions against prompt injection attacks. I expect their answer is the same auto-review mechanism as Codex.
我很想听听OpenAI如何保护ChatGPT Work会话免受提示注入攻击。我预计他们的答案会和Codex一样，采用自动审查机制。
OpenAI could make this a lot less confusing
OpenAI本可以让这变得不那么令人困惑。
Figuring this all out took way more work than it should have.
搞清楚这一切所花费的功夫远超应有的程度。
I think there are two key problems here:
我认为这里有两个关键问题：
- OpenAI explain Work in terms of what it's for, not what it actually does
- OpenAI still insist on hiding their system prompts and tools descriptions
- OpenAI在解释Work时侧重于它的用途，而非其实际功能。
- OpenAI仍然坚持隐藏他们的系统提示和工具描述。
更进一步：量化金融体系
看懂新闻只是起点——沿量化金融路径，把它变成能交付的工程能力