AI agents at the computer: What ChatGPT dots and others can do and what the GDPR says

Until now, AI assistants answered. The new generation acts. It opens web pages, clicks buttons, fills in forms and copies data from one program to the next. At the end of September 2026, OpenAI introduced dots, agents that work permanently in the background.[1] Anthropic, Google and Microsoft offer comparable features.

For companies, this sounds tempting, especially for processes without an API. At the same time, many hesitate. Among German companies that have considered AI but not yet introduced it, 62 percent cite unclear legal implications and 60 percent cite data protection concerns.[2] And even where AI is already in use, data protection is the most frequently cited obstacle, at 66 percent.[3] With agents that can see a screen, these concerns are particularly justified. This article shows what is available, what the agents can do and what you should look out for under the GDPR and the EU AI Act.

What a computer agent is

A computer agent works like a person at a screen. It takes a screenshot, recognizes fields and buttons on it, decides on the next step and sends mouse clicks or keyboard input. Then comes the next screenshot. Germany’s Federal Office for Information Security (BSI) describes AI agents as systems that carry out actions independently on the basis of a language model and often need far-reaching access rights to do so.[4]

What matters is where the agent works. There are two variants:

• In the provider’s cloud: The agent operates a virtual computer or browser in the provider’s data center.
• On your own device: The agent controls your browser or your desktop directly, with everything that is open and logged in there.

The offerings at a glance

OpenAI: dots and ChatGPT Work

dots are always-on agents in ChatGPT. They run on the GPT-6 Astra model, have their own cloud computer and can be addressed via ChatGPT, Slack or Microsoft Teams.[1] If you wish, they also work on your own laptop. This access is switched off at first. dots create their own memories, including from connected apps. If you disconnect an app, the data gathered stays with the dot. It can only be deleted by resetting the entire dot.[5]

For companies in the EU, dots are available with premium seats in ChatGPT Business. The Pro plan is excluded in the European Economic Area, Switzerland and the UK. Enterprise customers can use a beta that the administrator has to enable.[5] In addition, ChatGPT Work has a cloud browser that reads pages, clicks and fills in forms.[6] OpenAI has discontinued the former agent mode and Operator.[7]

Anthropic: Claude in Chrome, Cowork and Computer Use

Claude in Chrome works in the user’s browser. Since December 2025, the extension has been available on all paid plans, including Team and Enterprise.[8] Since March 2026, Claude Cowork has also been able to operate your own desktop, as a preview. Anthropic itself states that there is no sandbox between Claude and your programs.[9] For developers, there is Computer Use in the API. There, your own software carries out the clicks in an environment you control yourself.[10]

Google: Computer Use for developers and companies

In the Gemini API, Computer Use is a tool in preview status. The model suggests actions, and your own application carries them out.[11] For companies, a sandbox with an isolated browser has been generally available in the Gemini Enterprise Agent Platform since September 2026.[12] The “auto browse” feature in Chrome, on the other hand, is only available in the US.[13]

Microsoft: Copilot Studio and Researcher

In Copilot Studio, agents with computer use have been generally available since May 2026.[14] They run on your own Windows machines or in an environment managed by Microsoft, which is still in preview.[15] Researcher in Microsoft 365 Copilot uses a separate, isolated environment per conversation for computer use, separated from the corporate network.[16] One detail with consequences: in Microsoft’s offerings, Anthropic models are excluded from the EU Data Boundary and switched off by default in the EU.[17]

What the agents can do today and what they cannot

The agents research, compare offers, fill in web forms and transfer data between web applications.[6] This helps above all where there is no API.

They are not error-free. In the OSWorld benchmark for computer use, the vendors report scores between just over 70 and just over 80 percent for their best models, depending on the test version and including partial successes.[18][19] Conversely, this means that a good share of tasks are not completed in full. OpenAI itself writes that dots can make mistakes.[1] In its own test, OpenAI checked whether dots stay within the permitted scope across several tasks. There were no serious violations. With ten intermediate tasks, however, the dot overstepped its assignment to a moderate degree in just under 20 percent of samples. As an example, OpenAI mentions carrying information over between tasks that have nothing to do with each other.[20]

The biggest risk: hidden instructions

An agent reads everything on a page. Including text that an attacker has hidden there. Such instructions are called prompt injection. They can lead the agent to pass on data or do something nobody wanted. In an external test, attackers succeeded with such attacks against GPT-6 Astra in 8.5 percent of scenarios, with 15 attempts per scenario.[20] Anthropic writes that the risk is not zero even with safeguards.[21] Microsoft explicitly warns of such attacks in its documentation and recommends trusted, isolated environments.[22] At Google, detection of such attacks in the API is an add-on that has to be switched on first.[11]

Why their use is tricky under the GDPR

Everything on the screen is processed

A computer agent takes pictures of the screen. Whatever is visible there ends up with the provider: customer names in the CRM, emails in the inbox, salary data in an open spreadsheet. Anthropic points out that everything visible in the tabs being worked on ends up in the screenshots.[21] The GDPR, however, requires you to process only the necessary data and to design systems in a privacy-friendly way (Art. 5 and Art. 25).[23]

The provider processes data on your behalf

If you use an AI application from an external provider, the German Data Protection Conference (DSK) considers that provider to often be a processor. You then need a data processing agreement under Art. 28 GDPR.[24] OpenAI offers such an agreement for ChatGPT Business, Enterprise and the API.[25] The DSK also recommends providing employees with company accounts and devices instead of letting them use private accounts.[24]

Data is often stored in the US

At OpenAI, new Enterprise and Edu customers as well as eligible API customers can have their data stored in Europe. This only applies to the features explicitly listed. New features are excluded, and dots are not on the list.[26] For ChatGPT Business, OpenAI is currently rolling out the choice of storage location step by step. It only determines where data is stored, not where it is processed. And a copy of every input and response remains temporarily in the US for abuse monitoring.[27] Anthropic stores its business customers’ data in the US.[28] Since July 2023, transfers to the US have been covered by the adequacy decision on the EU-US Data Privacy Framework.[29] The General Court of the EU upheld it in September 2025.[30] However, an appeal against the judgment is pending before the Court of Justice of the EU.[31] So plan a fallback, such as standard contractual clauses.

Storage, deletion, purpose limitation

Ask how long screenshots and histories are stored. Anthropic deletes screenshots from Computer Use in the API after 30 days by default.[32] We did not find a specific retention period for dots in OpenAI’s documentation. The fact that dots keep data from disconnected apps makes deletion concepts harder. And if an agent carries information over between tasks, this touches on the principle of purpose limitation (Art. 5(1)(b)).[23]

Data protection impact assessment

For new technologies with a high risk, the GDPR requires a data protection impact assessment (Art. 35).[23] The DSK considers such an assessment necessary in many cases when AI applications are used.[24] With an agent that sees screens with customer data and acts on its own, you should assume that it is.

Employees and works council

An agent that reads along on workplace computers and logs everything can be subject to co-determination by the works council. The German Works Constitution Act gives the works council a right of co-determination over technical devices designed to monitor the behavior or performance of employees.[33] So involve the works council early.

What the EU AI Act requires

Since February 2025, the AI Act has required companies that use AI to take measures on the AI literacy of their staff (Art. 4). The Digital Omnibus redefined this obligation in 2026: since then, the aim has been to promote AI literacy, no longer to ensure a certain level.[34][35] An agent for normal office work is usually not a high-risk system. That changes, for example, when selecting job applicants or assessing loans. Stricter obligations then apply, for example on logging. After the postponement by the Digital Omnibus, these apply from December 2, 2027.[34][35] Regardless of this, under the GDPR you must be able to demonstrate that you comply with the rules (Art. 5(2)).[23] A log of what the agent saw and did is therefore part of it.

What a mid-sized company should do in practice

1. Only use business plans. With a data processing agreement, without training on your data and with company accounts.
2. Keep the scope narrow. One process, a few approved websites. Where there is an API, it is usually a better choice than an agent that clicks. More on this in the article Automation without AI.
3. Create a separate environment. The agent works in an isolated environment with its own logins and minimal rights, not on the managing director’s laptop. Anthropic also recommends a dedicated virtual machine for Computer Use, no login credentials for the model and a list of allowed domains.[10]
4. Build in approvals. Before anything is sent, bought, deleted or confirmed, a person decides. Switch off automatic approvals.
5. Keep sensitive data away. Anthropic advises against giving the agent access to sensitive programs such as online banking or health applications.[9] Close windows the agent does not need.
6. Document. Record of processing activities, data protection impact assessment, deletion periods and technical measures under Art. 32.[23]
7. Bring people along. Involve the works council, train employees, set clear rules for use. The BSI advises having important actions carried out only after confirmation and checking the agents’ logs regularly.[4]
8. Test small. First with test data, then with a real, low-risk process. Only then expand.

Conclusion

Computer agents are real progress for tasks where there is no API. But they see everything on the screen, and they act with your logins. In a company, they therefore need the same framework as a new service provider with access to your systems: a contract, clear tasks, limited rights and someone who approves. If you start this way, you can use the benefits without giving up control over customer data and liability.