OpenAI introduced Operator on January 23, 2025 as a research preview, alongside a system card for the model behind it: the Computer-Using Agent, or CUA. CUA combines GPT-4o’s vision with reasoning trained through reinforcement learning, and it operates a computer the way a person does - reading screenshots of a web browser and clicking buttons, choosing menus, and typing into fields, rather than calling website-specific APIs. That generality is the pitch: an agent that can in principle use any software a human can.
Operator put CUA to work on everyday browser chores - ordering groceries, booking reservations, buying event tickets - all under the user’s direction and oversight. The system card is candid about the new risk surface this opens. An agent that takes actions on the web is exposed to prompt-injection attacks, where malicious text on a third-party page tries to redirect it, and to the chance of making consequential mistakes. OpenAI’s answer was a layered safety approach: refusing high-risk tasks outright, requiring explicit user confirmation before sensitive actions like purchases or sending emails, and actively monitoring sessions.
Operator landed three months after Anthropic shipped its Computer Use feature, and together the two marked the moment that “agents that operate software by looking at the screen” moved from research demo to shipping product. The CUA approach was later folded into OpenAI’s broader agent offerings as the company merged browsing and computer use into ChatGPT itself.