OpenAI Dots Architecture: How Always-On AI Agents Work Under the Hood

Micro-VM Provisioning and Firecracker Container Isolation in OpenAI Dots

When OpenAI unveiled Dots during its autumn developer keynote, the announcement fundamentally altered the lifecycle of cloud-hosted artificial intelligence. Traditional conversational interfaces allocate compute strictly during the active token generation window; once the HTTP stream closes, the execution context evaporates into static database rows. By contrast, each OpenAI Dot operates as a continuously running Linux micro-virtual machine orchestrated across OpenAI’s dedicated container fleet.

Under the hood, Dots leverage custom Firecracker virtualization layers paired with copy-on-write overlay filesystems. When an enterprise user initializes a Dot inside a workspace, the orchestration controller mounts a persistent 64-gigabyte NVMe volume containing the agent’s local home directory, SSH keyrings, Python virtual environments, and Chromium browser profiles. Because the virtual machine state persists between prompts, a Dot can compile large C++ repositories, tail live Kubernetes log streams, or wait hours for asynchronous webhook callbacks without losing its working memory.

To prevent resource starvation across millions of concurrent instances, OpenAI engineered a three-tier hibernation scheduler. Active Dots executing shell commands or browser mutations run on high-frequency Genoa and Turin EPYC host nodes. When a Dot enters an idle listening state—such as polling a GitHub repository for pull request reviews—the hypervisor snapshots the guest memory pages to compressed ZRAM and suspends CPU scheduling, capable of waking the environment within 18 milliseconds of an incoming event trigger.

Headless Chromium Accessibility Trees and DOM Action Synthesis

A defining capability of OpenAI Dots is their native browser runtime. Earlier web-browsing plugins relied on brittle Markdown scrapers that failed whenever an application required multi-step OAuth handshakes, WebSocket state synchronization, or complex canvas interactions. Each Dot runs a hardened headless Chromium binary controlled through a bidirectional DevTools Protocol bridge.

• Semantic Accessibility Tree Serialization: Rather than feeding raw 5-megabyte HTML documents or high-token screenshots on every frame, the Dot runtime extracts a pruned Accessibility (AX) tree coupled with bounding-box coordinates for interactive elements.
• Visual-Spatial Verification Fallback: When encountering custom WebGL charts or obfuscated enterprise ERP interfaces (such as legacy SAP or Oracle forms), the agent dynamically captures viewport tiles and processes them through GPT-6’s native vision encoder to locate target controls.
• Hardware-Backed Ephemeral Credential Injection: Passwords and session cookies are never exposed to the language model’s text context. Instead, an out-of-band credential proxy injects authenticated headers and autofills sensitive fields directly into the browser network stack.

ChatGPT Space Multiplayer State Synchronization and Pages CRDTs

To support human-agent collaboration, OpenAI replaced its static chat sidebar with ChatGPT Space. Architecturally, Space is built atop a Conflict-Free Replicated Data Type (CRDT) synchronization engine similar to Yjs and Automerge. Both human engineers and assigned Dots act as peer nodes on the same document graph.

The 4,000-App Plugin Ecosystem and Model Context Protocol (MCP) Gateways

Connecting an always-on agent to corporate infrastructure requires standardized tool contracts. OpenAI Dots natively implement an enterprise-hardened variant of the Model Context Protocol (MCP), exposing over 4,000 commercial SaaS integrations through unified JSON-RPC tool servers.

When a Dot is tasked with triaging a production outage, it queries its local MCP registry to discover authorized tools: it pulls exception traces from Sentry, correlates deployment commits via the GitHub API, inspects P99 database latency metrics in Datadog, and drafts a root-cause remediation pull request. Every outbound API call traverses an enterprise policy gateway that enforces per-minute rate limits, schema validation, and role-based access control inherited from the organization’s Okta or Azure AD identity provider.

Hierarchical Memory Graphs and Episodic Context Compaction

An agent that operates continuously for weeks generates millions of tokens of terminal outputs, browser logs, and user instructions. Stuffing this raw history into a transformer context window would rapidly degrade attention accuracy and incur astronomical compute costs.

Dots solve long-horizon memory through a three-layer episodic compaction pipeline. First, raw execution logs are held in a rolling 128k-token active ring buffer. Second, a background consolidation worker periodically distills completed subtasks into structured entity-relationship triples stored in a local SQLite-vec graph database. Third, whenever the Dot begins a new planning cycle, a hybrid lexical-vector retriever injects only the relevant historical diffs, architectural invariants, and user preferences into the active system prompt.

Enterprise Rollout Tiers, FinOps Governance, and Operational Safeguards

OpenAI is rolling out Dots across ChatGPT Pro, Business Premium, and Enterprise tiers with granular FinOps controls. Rather than billing strictly per input/output token, enterprise administrators allocate “Compute Units” that account for both GPT-6.1 Sol inference passes and active micro-VM CPU-hours.

Administrators can configure mandatory human-in-the-loop approval gates for destructive tool actions—such as merging code to main branches, modifying billing records, or sending external customer emails. By combining persistent Linux execution with strict cryptographic sandboxing, OpenAI Dots establish the reference blueprint for autonomous digital coworkers in the modern enterprise.

Deep-Dive Implementation: Orchestrating OpenAI Dots via Firecracker Snapshots, eBPF Syscall Filters, and MCP Routers

To operationalize OpenAI Dots across an enterprise engineering organization of 2,500+ developers without incurring uncontrolled cloud compute sprawl or privilege-escalation risks, platform architecture teams must configure three foundational control planes: the Firecracker Snapshot Lifecycle Manager, the eBPF Kernel Security Policy, and the Internal Model Context Protocol (MCP) Federation Gateway.

During active task execution, a Dot’s virtual machine mounts two distinct block devices: a read-only squashfs root image (`rootfs.ext4`) containing verified compiler toolchains (GCC 14, Rust 1.84, Node 24, Python 3.13, Playwright Chromium) and a user-scoped encrypted overlay volume (`/workspace`). Whenever the GPT-6.1 Sol planner invokes the `bash` or `browser_action` tool, an embedded eBPF LSM (Linux Security Module) probe intercepts `execve`, `connect`, and `openat` system calls at the kernel boundary. Attempts to read raw cloud instance metadata (`169.254.169.254`), modify `/etc/resolv.conf`, or initiate raw TCP socket connections outside the corporate HTTP CONNECT proxy are dropped in kernel space with zero latency penalty.

For asynchronous multi-day workflows—such as monitoring a canary deployment across 48 hours and automatically bisecting regression commits if error rates exceed 0.1%—the Dot registers a declarative webhook listener with the ChatGPT Space orchestrator. Once the listener is armed, the Firecracker VMM flushes dirty guest memory pages to NVMe and suspends the process, reducing idle reservation costs by 94% until the Datadog or GitHub webhook payload wakes the micro-VM.

• Deterministic Environment Reproducibility: Workspace admins define a `.dotcontainer/devcontainer.json` manifest in each repository root so every spawned Dot initializes with identical linter versions, database migration CLI binaries, and test database seed fixtures.
• Granular OAuth Token Exchange (RFC 8693): When a Dot interacts with Jira or Snowflake via MCP, it never sees the user’s master refresh token; the MCP gateway exchanges the workspace session assertion for a 15-minute, single-project scoped access token.
• Automated Pull Request Provenance Attestation: Every Git commit authored by an OpenAI Dot is cryptographically signed with a dedicated hardware-backed SSH agent key (`Verified-Dot-Identity`), enabling branch-protection rules that require at least one human code owner approval before merging agent-authored diffs.

By treating each Dot as an auditable, least-privilege Linux microservice rather than an unconstrained chat session, enterprises unlock continuous 24/7 software maintenance, automated documentation synchronization, and rapid incident triage across global engineering squads.

Operational Checklist: Auditing Persistent Agent VMs in Production

Before promoting OpenAI Dots from engineering sandboxes to organization-wide production access, platform security teams should validate a five-point operational checklist across their identity and cloud perimeters:

• Enforce Per-Dot Ephemeral SSH Certificates: Replace static deploy keys with short-lived HashiCorp Vault SSH certificates valid for 4-hour windows, bound strictly to the specific Git repositories assigned to that Dot’s workspace.
• Configure Egress DNS Sinkholes: Route all Firecracker micro-VM DNS queries through an internal CoreDNS resolver that logs domain lookups and blocks unapproved external webhook destinations or pastebin services.
• Set Automated Token & CPU Circuit Breakers: Configure workspace-level hard caps (e.g., 2.5 million GPT-6.1 Sol tokens or 6 vCPU-hours per task thread) to ensure recursive debugging loops pause automatically and request human review.

Organizations that pair OpenAI Dots’ persistent state architecture with disciplined container hygiene routinely cut routine DevOps triage backlogs by over 60% within their first 30 days of deployment.

Telemetry Benchmarking: Measuring Cloud-VM Session Overhead in Production

In internal benchmarking of OpenAI Dots instances executing 72-hour continuous sprints, virtual machine snapshot serialization added an average of 410 milliseconds per state transition while consuming 1.8 GB of incremental block storage per day. Engineering teams deploying Dots across more than 250 concurrent developer seats should provision dedicated webhook ingestion queues to prevent Slack and GitHub event bursts from triggering rate-limit backpressure on the ChatGPT Space coordinator.