Simon Willison counted 223 tools and 44 skills inside ChatGPT Work, and OpenAI documented none of them

Your harness can do things its documentation never mentions. This is now demonstrated, not argued.

Willison's August 30 post reverse-engineers ChatGPT Work, the tier OpenAI announced on July 9, into a concrete capability list (simonwillison.net). Model selection across Sol, Luna and Terra at multiple reasoning levels. Code execution with unrestricted internet access. A headless Chrome browser. A filesystem that persists across sessions. ChatGPT Sites deployment through Cloudflare Workers. Sub-agent coordination. Scheduled automations. 223 registered tools, 44 skills. None of it appears in OpenAI's own marketing, which describes intended use cases. Free and $8/month Go users get none of it.

He also put the extracted specifications up as a browsable static site you can grep, covering document creation, PDF handling, spreadsheet manipulation and dashboard building (codex-tool-reference.simonw.chatgpt.site). The artifact rather than the argument. Both submissions front-paged separately.

Two things follow. First, the buying decision changes. "Code execution with unrestricted internet access and a persistent filesystem" is a security review, not a feature bullet, and if your organization approved this tier based on the marketing page, your threat model is out of date. A headless browser plus persistent storage plus scheduled automations is a standing capability sitting inside your SSO perimeter.

Second, Willison's stated position is that vendors should publish system prompts and tool specifications themselves instead of leaving users to reconstruct them. I agree, and I do not expect it to happen. The tool list is the product. Publishing it hands competitors your capability roadmap and hands red-teamers your attack surface in the same document. But the current equilibrium, where the only accurate documentation of a paid product is written by someone outside the company, is worse for everyone including the vendor.

Put this next to OpenClaw shipping sandboxing off, and the pattern is uncomfortable: what your harness can do is not what its docs say, in both directions. OpenClaw's docs describe security features that are inert until you enable them. OpenAI's docs omit capabilities that are live by default. Same failure, opposite sign.

If you run agent tooling in production, go read the tool registry yourself. Not the marketing page, not the changelog. The registry.