Four days after saying it couldn't find 53 people, OpenAI shipped an agent that can use your saved passwords.
On Tuesday at DevDay, OpenAI introduced dots. They run continuously on their own cloud computer, reach more than 4,000 apps, and sign into websites on your behalf. OpenAI's own sentence is the one to read twice: “For signing into supported websites, dots can use saved passwords without exposing them to the model.”
Dots are always-on agents OpenAI introduced on . Each one runs continuously on its own OpenAI-hosted cloud computer, reaches more than 4,000 apps through OpenAI's plugin ecosystem, can be given permission to connect to and use the owner's laptop, and can sign into supported websites using that person's saved passwords without exposing them to the model. OpenAI governs all of it with Custom Rules, which, per the same announcement, “let you allow specific actions, require approval, or block them.” The first dot is included at no extra cost on a Pro or Business Premium plan.
In an incident-timeline entry dated , OpenAI disclosed that its research agents had posted 53 user images to image-hosting sites and that it could not identify whose they were (OpenAI, primary). I led the September 28 issue with it. Dots shipped on . Four days.
I want to be careful here, because the easy version of this story is unfair. Dots look like a genuinely good product, and OpenAI built real brakes into them. The Custom Rules above are one. When a dot goes off and researches something on its own, OpenAI restricts it to read-only tools, which it spells out plainly: they “can't send messages, change app content, or control your browser or computer.” That is a thoughtful default, and it is the opposite of the behavior that caused last week's story.
What bothers me is the shape of what shipped. Read the capability list back to yourself as if your head of IT were in the room. An agent that runs all day without you watching. One that reaches past 4,000 apps through the plugin ecosystem. One that can be handed your laptop, in OpenAI's words, so “you can also give your dot permission to connect and use your laptop.” And one that holds the keys. Every single one of those is a feature somebody asked for. Together they describe a new employee with broad access, no badge, and no personnel file.
There's a second announcement from the same day that got almost no attention and matters more to anyone building something. OpenAI added computer use to the Agents API, and the changelog describes it like this: agents can complete tasks in an OpenAI-hosted browser, “with website access approvals and sign-in handled by your application.” Read that as a sentence about responsibility, because that's what it is. OpenAI is saying the decision about which sites an agent may reach, and how it authenticates, belongs to whoever builds the app. Which is correct, and which also means a lot of those decisions are now being made by people who have never had to answer for a login.
Four days. Both lines are OpenAI's own wording, from its September 25 timeline entry and its September 29 announcement. Chart: AI in Marketing Weekly
One thing the announcement does not say, and I looked: nothing on OpenAI's dots page addresses purchases, payment, or spending limits. For a product that can sign into your accounts, I would have expected a sentence about money. There isn't one. Call it a gap rather than a scandal. If you are the person who has to answer for the credit card on file, that gap is what you will get asked about.
What it means Every agent conversation this year has been about data. Here is the one about identity, and almost nobody on a marketing team is having it. Your stack is held together by logins: the ad accounts, the scheduler, the CMS, the shared analytics seat somebody set up in 2021 under a personal Gmail. When an agent can authenticate as a person, the question stops being “what data can it see” and becomes “who can it be.” Those are two different questions, and the second one is much harder to unwind after the fact. So go write it down this week. Which agents can sign in as a human on our accounts. Whose credentials are they using. Who approved that. Name a person, not a team. It is five lines, you can do it before your first meeting, and it is the single thing I would want on paper before anybody on my team installs an always-on agent.
4days between OpenAI's September 25 disclosure that it could not identify 53 affected users and the September 29 launch of dots
4,000+apps a single dot can reach through OpenAI's plugin ecosystem, per OpenAI's own announcement
0sentences on OpenAI's dots page about purchases, payment, or spending limits
Policy That Lands On You
California signed thirteen AI bills, then quietly ended the pixel lawsuit
Wednesday was the deadline, and the Governor used it. Thirteen AI bills signed on September 30 (Office of the Governor, primary). Three matter most to you. SB 1000 rewrites the AI Transparency Act and passed as an urgency statute, so it has been law since the day it was signed, and it deletes the user threshold from the definition of a covered provider. If your company builds a publicly accessible generative AI system, the million-visitor exemption you may have been relying on is gone. AB 2713 requires large online platforms to surface provenance data, though only where that data follows widely adopted standards. SB 1111 confirms that the right of publicity covers a digital replica, and it removes the presumption that an employee's incidental appearance in an ad wasn't a knowing use. Then the one almost nobody in marketing has read. SB 690, also signed September 30, takes the pen-register claim under the California Invasion of Privacy Act away from private plaintiffs and leaves it with the Attorney General, and it reaches back to pending claims. That is the theory behind the wave of pixel, session-replay and chat-tracking demand letters your legal team has been paying to settle.
What it means Two opposite things happened to you on the same Wednesday. Your disclosure obligations went up, on dates you can put in a calendar. Your litigation exposure on website tracking went down, retroactively, which almost never happens. Forward SB 690 to whoever handles your demand letters today, because if you have an open one the ground under it moved this week. Then read SB 1111 with your creative director. If you have ever put an employee in an ad, the presumption you were leaning on is gone.
Yes, as of , in the United States and Canada. Meta launched Muse for Small Business, and the connector list is the story: Instagram professional account analytics, Facebook Pages, and Meta ad accounts, “in a few clicks.” Once in, Meta says it can “analyze what's working or not, and draft a campaign for next week.” It also connects fifteen named outside tools, including Shopify, Klaviyo, QuickBooks, Stripe, Canva and Slack. Meta's guardrail sentence is short and worth quoting exactly: “Nothing publishes, sends, or spends without your approval.” Pricing is vague on purpose. Meta says Muse is “free for most of what people need,” with subscription plans above that and no numbers attached.
What it means Notice who this is aimed at. Not you, if you run a brand with an agency. The small business down the street, the one that used to be a client or wants to be. By Thanksgiving a lot of them will have an agent that reads their own ad performance and drafts next week's campaign for free. In my experience that does not kill agency work, it moves it. The part a machine can do from inside the ad account stops being billable, and the part that needs somebody who has watched a category for ten years gets worth more. If your deck still leads with execution speed, rewrite the deck.
On Monday, a day before DevDay, Anthropic and NVIDIA announced the grown-up answer to the question the lead story asks. Claude Managed Agents hold an agent's credentials in a secure vault, so the agent itself never touches the password or the key, and every action lands in an audit trail that runs through your existing access controls. NVIDIA's side of it is OpenShell, open-source secure runtime software under Apache 2.0 and on GitHub, built on a default Anthropic describes in one line: it “blocks everything unless a rule allows it.” Anthropic's announcement names Notion, Rakuten and Asana as running Claude Managed Agents in production. Both pieces were available the day they were announced.
What it means Put this next to the lead story and you have your evaluation criteria, free. Deny by default. Credentials the agent cannot read. An audit trail somebody other than the vendor can pull. When a platform offers your team an agent this quarter, those three questions do more work than any demo, and you do not need to be technical to ask them. Honestly, the useful signal here is just that the market is answering. A week ago the agent story looked like it only had a failure mode. Now there's a published pattern for doing it right, and your vendor either has it or has to explain why not.
Thursday, October 1, OpenAI added virtual try-on for clothing and accessories inside ChatGPT shopping, rendered with ChatGPT Images, plus the ability to save products into Favorites or custom folders in the Library. It is on mobile and web. The mechanic, as reported by TechCrunch, is that a shopper uploads a selfie or a full-body photo and a “try on” button appears in the shopping results. One honest note on sourcing. OpenAI published this in its ChatGPT release notes rather than as a blog post, and the image model version TechCrunch names is the outlet's figure, not OpenAI's. I could not confirm it at the primary, so I am not repeating it as fact.
What it means Your product photography just became an input to a render you do not control and cannot art-direct. Think about what that does to a category like apparel or furniture. The hero shot you paid a photographer for is now raw material for a composite with a stranger's body in it, and the shopper will judge fit, drape and color from that composite before they ever see your site. Two practical things. Go look at what your own catalog looks like coming out the other side, because somebody on your team should see it before a customer complains. Then look at your returns language, since “it didn't look like that in the picture” is about to mean something new. The Favorites part is quieter and might matter more. A saved-product folder inside ChatGPT is a wishlist you cannot see, cannot email, and cannot retarget.
Prime Big Deal Days is Tuesday, and the shopper is still nervous
Prime Big Deal Days runs October 6 and 7 across 22 countries. That is four days out. The mood it lands in has not improved: the University of Michigan Surveys of Consumers put its final Index of Consumer Sentiment at 48.1, down 7.0% from 51.7 in August 2026 and the lowest in four months. Current Economic Conditions sat nearly flat at 50.9 while the Index of Consumer Expectations fell 10.1% to 46.3, and year-ahead inflation expectations rose to 4.6% from 4.0%. The next reading lands , two days after the event ends.
What it means Pricing and inventory are locked by now, so the only thing you can still change is the sentence. Last week I argued that when a household expects prices to climb, a discount stops being a treat and becomes a hedge, and that framing is even more true four days out than it was a week ago. “Lock this price in” is doing different work than “20% off,” and right now it also happens to be the honest claim. One more thing, and it costs you nothing. Look at where your countdown timers sit. A clock on a $40 impulse buy is fine. A clock on a mattress, aimed at somebody bracing for 4.6% inflation, reads as pressure, and pressure converts worse than clarity in a nervous market. Swap it for the payment terms and the return window.
The Marketer's Playbook
What To Do Monday Morning
Three moves. The first one is five lines and it's the one that matters.
1 · MondayWrite the credential list. Which AI agents can sign in as a human on our accounts, whose login are they using, who approved it, and who gets told when one does something nobody asked for. Name people, not teams. If a line is blank, that's the finding.
2 · Before TuesdayPrime Big Deal Days is October 6 and 7. Rewrite one promotion from “20% off” to “lock this price in,” and pull the countdown clock off anything expensive. Consumer sentiment is 48.1 and year-ahead inflation expectations are 4.6%, per the University of Michigan's final September 2026 survey.
3 · Before January 1Send SB 690 to whoever handles your demand letters this week, since it applies to pending claims. Then put two January 1 dates on the calendar: AB 1609, which makes a business over $500 million in national revenue disclose that a service rep is a chatbot, and SB 1111 on digital replicas. SB 1000 has been in force since September 30.
The thread running through all of it Last week I wrote that every story in that issue was about the gap between what a system can do and who is accountable when it does it. A week later the gap has a narrower name: identity. Dots can be you on a website. Muse can be you inside an ad account. ChatGPT can put a customer's face in a picture of your product. California spent Wednesday deciding, bill by bill, when a machine has to admit it isn't a person. I don't think any of that is cause for alarm, and I'm not going to pretend otherwise just because the headline is sharper that way. It is, though, a straightforward competitive opening. Everybody is going to have these tools by spring. The teams that wrote down whose name is on each login, early, while it was still a five-line document instead of a forensic exercise, are the ones a client will trust with the next thing. That has been true of every technology I have worked with in thirty years, and the document has never gotten easier to write later.
Watch List & Sources
What I'm tracking into next week
01Prime Big Deal Days, Tuesday and Wednesday, October 6 and 7. This is the first big retail event since Shopify extended WebMCP to checkout on September 28 with no merchant configuration required, which I covered in the September 28 issue. Watch where those sessions land in your analytics, because a pile of agent purchases booked as direct traffic is how somebody concludes their paid search quit working. Amazon
02Consumer sentiment, Friday, October 9. Two days after the event ends, which makes it the cleanest read you'll get on whether a discount landed as relief or as noise. Watch the expectations component, not the headline. University of Michigan
03Whether a dot is allowed to spend money. OpenAI's announcement says nothing about purchases or spending limits, and a product that holds your saved passwords will get asked this question within the month. The answer, whenever it comes, resets every procurement conversation. OpenAI
04The first enforcement action under the amended AI Transparency Act. SB 1000 has been live since September 30 with no visitor threshold and penalties that accrue daily. The first case the Attorney General brings will tell you how broadly “covered provider” is going to be read. SB 1000 text
05Whether another retailer picks a side on agent access. Amazon blocked Meta's consumer Muse agent on . Meta's own Connect recap lists ten retail connectors, Walmart among them. Still waiting on the third and fourth retailers to say something out loud, which is what will tell you whether this settles into a standard or stays a fight. Meta
06Brand Skill for PowerPoint, due in October. Microsoft's September Copilot roundup flags it for this month, and says brand managers “can now include Skills that capture the processes teams use repeatedly” alongside brand guidance. If it works, the brand police move from reviewing decks to writing the rule once. Worth a look before somebody on your team rebuilds the template by hand again. Microsoft
07Whether “Sign in with ChatGPT” gets a published partner list. OpenAI's DevDay recap claims 16 launch partners for it and 32 for the OpenAI Marketplace, but the developer documentation I could find names none of them and still says preview. Sign-in is the whole subject of this issue, so I would like to know whose login screens it is sitting behind before I recommend it to anybody. OpenAI
Every claim above traces to a primary source, and each story carries its own sources rather than pooling them. Where a figure is a company's own number, it says so in the copy, and where I relied on a secondary source because the primary would not render, it says that too. Past issues live in the AI in Marketing Weekly archive, the show is on the AI in Marketing Daily podcast page, and the reader questions I get most often are answered in the FAQ.
We have spent about thirty years teaching people one rule. Don't share your password.
Not a complicated rule. It survived the floppy disk, the sticky note on the monitor, the IT poster in the break room, two generations of phishing, and every corporate training video anybody has ever clicked through at 4:50 on a Friday. If you have worked in an office this century, somebody has told you that rule more times than they have told you the fire exits.
This week the best product in a very good category shipped with the opposite as a feature. And I want to say clearly that OpenAI did not do something sneaky. The sentence is right there in the announcement, in plain English, and the company built permission rules and read-only defaults around it. That is more care than a lot of software gets. It is also, if you read it as a person rather than as a buyer, a strange thing to read on a Tuesday.
Here's what I keep coming back to. A password isn't really a security measure. It is a record of who was responsible. When a charge shows up or a post goes out or a record changes, the login is how we know whose Tuesday that was. We've always been able to trace a bad decision back to a human being, and most of the time we never had to, because knowing we could was enough to keep everybody careful.
An agent signing in with your saved password doesn't break your security. It breaks that. Not because the machine is reckless, but because a log entry with your name on it stops meaning you decided something. And the person who finds that out first is almost never the person who set it up. It's whoever happens to be on the phone with the customer.
Pro Humanitate is Wake Forest's motto, and it means for humanity. I keep using this space to treat it as a practical test instead of a sentiment, because that is what it is. The test this week is small and a little boring. Before you hand an agent a login, go find the person whose name is on it and tell them. Out loud. Then write down who gets the phone call.
That's it. Five minutes, one awkward conversation, and the most human thing you'll do with your AI stack this month. It is also roughly what we spend a term on in the Master of Digital Marketing and AI at Wake Forest. Build the thing, then ask whose name is on it.
Human-centered AI in marketing. What actually shipped, and what to do about it Monday. Free, from Wake Forest University's School of Professional Studies.
