A line of text that was never meant for the public spent a short while sitting on OpenAI’s website, and it named a product the company has yet to announce. The $100 ChatGPT Pro plan listed “o, your always-on assistant” among its benefits, right beside the storage and usage perks that buyers already pay for. Then it vanished. Users on X had already saved the screenshot, and the questions an OpenAI always-on assistant raises start long before any launch event.
What the leaked line showed
The entry sat with the other Pro perks. Those cover more Work and Codex use, the top memory tier, 100GB of storage, and early access to new tools. That grouping matters, because a feature parked in the top paid tier suggests OpenAI plans to ship the always-on assistant widely. This looks like no quiet trial for a few testers.
A second clue sat deeper in the site code. There a dynamic setting paired the display name “o” with an email suffix of “-o”. Those two values point to an agent with a name of its own, and maybe an address you could write to. Nothing on the page said how the email side would work.
What an OpenAI always-on assistant would need from you
Most AI tools work in short bursts that begin and end with you. You open a chat, ask a question, read the answer, and close the tab behind you. An OpenAI always-on assistant breaks that pattern. It keeps working while you sleep, while you commute, and while you sit in a meeting with the laptop shut.
Work that never pauses needs access that never pauses, and that trade sits at the centre of the story. An agent handling your mail at 3am needs your inbox, your logins, and your calendar open at 3am. The risk window stops being one short session. It becomes a standing setup, live for as long as you leave the feature switched on.
Email access carries the heaviest risk
Your inbox is the richest target in your digital life, and password reset links are the reason. It holds bills, contracts, medical letters, tax records, and years of private mail. An OpenAI always-on assistant with mailbox rights would inherit that whole archive by default.
Attackers know the value, so they aim at inboxes first. A hacked account used to mean leaked old mail. Now it could mean leaked memory, a record of every task you ever handed over, and an agent that sends mail in your name until someone spots it. Clean-up gets harder when a thief inherits an assistant.
Prompt injection moves into the inbox
Prompt injection works by hiding instructions inside content that an AI system reads and trusts. A crafted email can speak past you to the agent, telling it to forward a thread or copy something quietly to an outside address. Nobody has to click a thing. An always-on assistant from OpenAI would open that message on its own schedule, and the attack fires the moment it does.
Guardrails help, filters help, and tight limits help more than both. No firm has solved it, though. An assistant with standing rights to read and send is a far bigger prize than a chat window. So the effort aimed at breaking it grows with every new user.
Memory makes the picture bigger
Maximum memory appeared in that same list of perks, which fits an OpenAI always-on assistant built to remember across sessions. Long memory is what makes an agent feel smart instead of blank. It also builds a lasting record of your habits, your contacts, your spending, and the things you worry about at night.
Records like that draw legal demands, insider snooping, and breach risk in roughly equal measure. Most people never find out where their memory lives, who can read it, or what survives a delete request. Ask for those answers first. Handing an always-on assistant from OpenAI the keys to your archive is worth ten minutes of reading.
DevDay could fill the gaps
OpenAI hosts DevDay 2026 on September 29 in San Francisco, with talks, demos, and new tools on the schedule. A feature this big would fit that stage, though OpenAI has stayed quiet about the always-on assistant so far. Separate notes on an in-house system called Aeon point at custom agents for ChatGPT workspaces, which looks like a different track.
The price tag says something useful too. A $100 tier points to real compute cost behind the feature, because an agent that works while you sleep burns money while you sleep. It also suggests OpenAI wants its heaviest users first, and heavy users hand over the most data.
Steps to take before an OpenAI always-on assistant lands
Treat mailbox access as a decision rather than a checkbox during setup. If your provider allows it, run AI links through a spare account, and keep banking, tax, and ID mail somewhere else. Read every scope you grant, because most services ask for far more than the job needs.
Network hygiene matters as well, above all for people working from cafés, airports, and hotel Wi-Fi. A VPN encrypts the traffic between your device and the services an agent touches. That keeps session data away from anyone watching the local network. It will not stop a bad email, but it does remove one weak point, and chains break at the weak points.
The basics carry the most weight here. Use long unique passwords, a hardware key or app codes, and a monthly look at which apps hold live access. Cut off the ones you stopped using months ago. Every linked app is a door, and the doors you forget about are the ones nobody guards.
Final Thoughts
An OpenAI always-on assistant would change the relationship people have with AI, turning a tool you visit into a service that runs beside you all day. For anyone buried in mail, that sounds like relief. The cost sits in plain sight, because access that never sleeps is risk that never sleeps.
OpenAI has confirmed nothing, so the always-on assistant may ship in a very different shape. Still, the industry is moving this way, and the hard questions land on users rather than on vendors. Decide now what you would let an agent read on your behalf. That answer gets much harder to reach with the setup screen already open.
