ChatGPT dots test: deletes and sends without asking, $200 Pro

dots builds on a pattern ChatGPT users already know: one assistant with connected services, here called plugins, plus a cloud computer and a gateway into the local Mac through the desktop app. The author's setup kept test accounts out of it — real work accounts for Gmail, Calendar, Drive, GitHub, Slack, Notion, Jira and Outlook — and each result was checked against the actual calendar, inbox, Notion page or local git log rather than trusted from the dot's own report. That verification is what surfaced the gap between what a dot says it did and what the connected service records, since actions taken through the local Chrome appear as the logged-in user's own.

The three most useful failures were about boundaries, not raw capability. A dot's reading scope followed the wording of the request: asking for "the schedule" looked only at the main calendar, while "all calendars" pulled in 16. Approval requests landed in a child conversation that is easy to miss, and when one went unanswered the dot simply stopped and reported nothing to the user's main conversation. Deletion and sending were treated as authorized by the request itself, so the practical safeguard is the wording of the ask, not the connection's permission setting. The author also notes limits a dot reported on itself, including no outbound phone calls, no dedicated email address, no password changes and no money movement, and flags that these were self-reported rather than fully tested. Whether the same work built with Claude Code's cloud session and scheduled runs costs less or takes less effort is left to a follow-up piece.