The browser tool loads arbitrary pages and will execute JavaScript against their DOM [12]. The filesystem persists between sessions [11]. Outbound network is on, and the allowed-domain list, according to Willison, is configurable with a default that appears to be open to all [9]. Put those together and text from a page nobody on your team wrote can reach a session that has durable storage and an unrestricted socket. Each of those features is defensible on its own, which is exactly why the composition is the thing to review.
Anthropic went the other way, with an allowlist short enough that Willison can summarise it in three items [10]. That design buys dependency installation and forecloses talking to a vendor API. Work has the same control with the polarity reversed: name the domains you want, or inherit all of them [9]. If the default is what Willison observed, the config line is the whole conversation, and it is a line somebody has to write before the first useful task.
Work Local is the desktop app that used to be Codex, and it reads files and runs programs on the machine it is installed on [3]. Willison reads it as Codex re-skinned to be less intimidating to people who are not software developers [4]. That is a fair description of the adoption risk, because the population being handed a program runner is the population least likely to hold a model of what a program runner can do. Work Cloud runs in OpenAI's infrastructure and is reached from chatgpt.com or the mobile apps [2]. One name, two boundaries, and the interface presents Work as a tab alternative to Chat rather than as a different capability class [18].
The configuration surface is also bigger than that tab selector suggests. Work exposes GPT-5.6 Sol, Luna and Terra at Light, Medium, High, Extra High, Max and Ultra, plus GPT-5.5 at the first four of those levels [13]. Three models times six levels is eighteen, plus four, so 22 selectable model-and-effort combinations, against the five options Chat offers, with 5.6 Pro running the other way as Chat-only [15][14]. No team is going to bench 22 configurations, so in practice one gets picked and whatever it does becomes the house default.
"Appears" is Willison's word about the egress default [9], and it is measurable in about ten minutes: from inside the container, request a host you control, then read your own access log. Worth repeating on a schedule, too. Willison reports that Chat's container could install packages back in January and cannot now, and that he found this out by trying rather than by reading a changelog [19]. A capability inventory assembled by experiment carries an expiry date the vendor does not publish.
In my context Work Cloud earns the seat, with the allowed-domain list narrowed before anything points at a private repository, and Work Local reviewed the way any other local process executor gets reviewed. OpenAI's own guidance, which says use Chat for an answer or short draft and Work for a task with a clear outcome, will not help anyone make that call; Willison calls it almost entirely useless because he has been doing all of those task types in Chat for years [17].
