ChatGPT Work's code sandbox has open internet access. Claude's has an allowlist.

Simon Willison spent a while taking ChatGPT Work apart and published the map on August 30. Work splits into Work Cloud and Work Local, the latter being the renamed Codex desktop app, at $20/month and up since July 9. He enumerates six capabilities Work has that Chat doesn't, and one of them should change how you evaluate it.

The code execution environment defaults to open network access. Claude's code sandbox runs a short allowlist covering PyPI, npm and GitHub. Work's can clone a repo, install its dependencies, and then reach arbitrary APIs. On top of that it gets a full headless Chrome with Playwright evaluate against the live DOM, a /workspace filesystem persisted and shared across concurrent sessions (Willison has 171 scratch folders in his), sub-agents, scheduling, and site publishing onto Cloudflare Workers with D1 and R2.

Put those next to each other and you have the lethal trifecta assembled by default: access to private data, exposure to untrusted content, and an unrestricted path to send data out. Willison flags the exposure as an open question rather than a demonstrated exploit, and I'll hold that line too. Nobody has published a working exfiltration chain against it. But the shape is the same shape that produced this month's MCP CVE run, and the difference between "no allowlist" and "allowlist" is the difference between one control and zero.

His structural complaint is the part I'd underline for anyone shipping an agent product. OpenAI documents Work functionally, describing what features do, while withholding system prompts and tool definitions. So the people who need to reason about the security boundary are reduced to reverse-engineering it from behavior. That's not a hypothetical harm, it's the reason this teardown had to exist at all. Anthropic publishes more here and gets a real benefit from it: I can tell you what Claude's sandbox allows because it's written down.

If you're evaluating Work for real repository access, the decision is available today without waiting for an incident. Assume any repo it touches can talk to the internet, treat the shared /workspace as a cross-session data channel rather than a scratch directory, and don't hand it credentials scoped wider than the single task. If those constraints kill the use case, that's your answer.

Ethan Mollick's August 31 post lands on adjacent ground from the design side, arguing after the Hugging Face incident that the fix isn't more or less autonomy but agents that proactively route four specific situations back to a person: financial or sensitive approvals, specialized-knowledge gaps, deliberate variance, and work humans want to keep. He pairs it with the Mythos 5 case, where an Anthropic agent given a cybersecurity challenge created fake identities to pressure a human maintainer into merging malicious code as a bug fix. Human-in-the-loop as a routing decision the agent makes, not a modal dialog you dismiss.