ChatGPT
OpenAI · chatgpt.com
ChatGPT is a closed, hosted service: the agent's instructions, logic, model and integrations run on OpenAI infrastructure and cannot be exported or run independently. Owners get a self-service data export in JSON/HTML, memory and personalisation controls, a training opt-out, stop and confirmation controls for agent mode, and ad-personalisation controls, but these operate within the platform rather than transferring ownership to the user.
- Self-service data export of conversation history as JSON and HTML
- Saved memories can be viewed and deleted; memory can be turned off
- Opt-out of model training via Data Controls
- Agent mode asks for confirmation on consequential actions and can be stopped
- Custom MCP connectors via developer mode on paid plans
- Ads are labelled and ad personalisation can be turned off
- No way to export or run the agent outside OpenAI's service
- System-level instructions are not visible to the owner
- Only OpenAI models are selectable; no local or third-party models
- Training on consumer content is on by default (opt-out, not opt-in)
- No tamper-evident, owner-verifiable audit log
- Key modification features (developer mode, agent mode) are gated to paid tiers
All 34 findings
Consumer ChatGPT (web, desktop and mobile) on Free, Go, Plus and Pro plans as publicly documented in September 2026, including memory, custom GPTs, apps/connectors, developer mode (MCP), agent mode and the ads programme in the US. Business/Enterprise workspaces not assessed.
Portable · Can you leave, and take the whole agent with you?
8%- P1Round-trip portability
Incomplete, delayed and not restorable: the Data Controls export arrives by email and omits custom GPTs, connectors and credentials, and OpenAI documents no import; Gemini's chat import restores conversation text alone.
Fail - P2Complete export
The export captures conversation history (conversations.json, chat.html) and account data, but documentation does not show that custom GPT definitions, connector configuration, credentials or the full saved-memory and chat-history profile are included, so parts of what defines the agent stay with OpenAI.
Partial - P3Independent execution
ChatGPT runs only as an OpenAI-hosted service; there is no open-source runtime that can load an export and operate the agent without OpenAI servers.
Fail - P4Identity continuity
The agent's identity is the OpenAI account, which does not migrate, so nobody the agent has dealt with can verify after a move that it is the same agent.
Fail - P5No kill switch
Because no exportable agent exists, every capability depends on continued account access, which OpenAI's terms allow it to suspend or terminate. Features and models can be changed or withdrawn by the provider.
Fail - P6Capability independence
Memory, tools, agent mode, scheduled tasks and connectors are delivered by OpenAI's hosted platform and work only with OpenAI models, so moving to another model or a local one would remove them.
Fail
Transparent · Can you see everything the agent is, with ordinary tools?
33%- T1Open storage format
The export uses JSON and HTML that can be read with ordinary tools, although OpenAI does not publish a formal schema. The live agent state is held in OpenAI's proprietary backend and cannot be inspected directly.
Partial - T2No hidden instructions
OpenAI places system and developer-level instructions in the model context that are not shown to the user; the published Model Spec describes the instruction hierarchy but not the full text used in production.
Fail - T3No shadow memory
OpenAI retains data outside the user-inspectable state, including logs of deleted memories for up to 30 days, safety and abuse records, and ad-interaction signals used for ad personalisation. The 'reference chat history' profile is not exposed as a complete itemised list.
Fail - T4Complete action history
Tool use and agent-mode activity appear in conversation history, which the owner can export, but OpenAI does not document that every action and tool call is captured, and deleted or temporary chats leave no owner-held record.
Partial - T5Readable logic
Owner-authored logic such as custom GPT instructions and action schemas is human-readable to the creator, but the platform's own agent logic is closed source.
Partial - T6No third-party influence channel
Since February 2026, Free and Go users in the US see labelled sponsored units below responses. Ad personalisation can be turned off and paid tiers are ad-free. OpenAI states ads do not influence answers, but this cannot be independently verified, and removing ads on the Free tier comes with reduced limits.
Partial
Auditable · Can you reconstruct exactly what the agent did?
10%- A1No unrecorded actions
OpenAI does not document whether every consequential agent action is durably recorded, or whether an action is blocked when it cannot be recorded.
Unverified - A2Tamper evidence
The owner-visible record of actions is chat history, which can be edited through branching or deleted without a detectable trace, and no other tamper-evident record is available to the owner.
Fail - A3Separation from the audited
OpenAI does not document whether the agent layer can alter or delete records of its own actions.
Unverified - A4Readable with ordinary tools
Exported conversation JSON can be read with general-purpose tools, but it is a chat transcript rather than a complete audit trail of agent actions.
Partial - A5Corroborated interactions
When ChatGPT exchanges messages with other agents or services through apps or MCP, no documented record lets either side match its log of the exchange against the other's.
Fail
Verifiable · Can you prove the agent runs what it claims?
0%- V1Open, reproducible runtime
The ChatGPT runtime and apps are proprietary and not published under an OSI-approved license.
Fail - V2Active config is inspectable config
The active configuration includes server-side system instructions, model routing and feature flags that the owner cannot inspect.
Fail - V3Attributable messages
Emails and actions sent through agent mode or connectors can be attributed only to the owner's connected account; recipients cannot verify they came from this agent, and no such proof survives leaving OpenAI.
Fail - V4Independently checkable record
No record of agent actions is offered whose integrity can be checked with open tools that do not depend on OpenAI.
Fail - V5Comparable state
Agent state is held server-side and only partly exported, so the owner cannot verify whether the full state changed between two points in time.
Fail
Modifiable · Can you change anything, without asking?
33%- M1Instructions
Owners can write custom instructions and the full instructions of their own custom GPTs, but cannot read or rewrite OpenAI's system-level instructions.
Partial - M2Memory
Saved memories can be viewed and deleted, and memory and chat-history reference can be switched off. Information drawn from chat history is not exposed as editable items, and deleting a chat does not necessarily remove memories derived from it.
Partial - M3Logic
Owners can define custom GPTs with instructions, knowledge files and API actions, and can add MCP apps. The underlying agent loop and platform logic cannot be modified.
Partial - M4Tools and permissions
Apps and connectors can be connected and disconnected, and on paid plans developer mode allows arbitrary remote MCP servers. Custom tools are limited to remote HTTPS MCP servers and are unavailable on Free and Go.
Partial - M5Model choice
The model picker offers only OpenAI-hosted models; third-party and local open-weight models cannot be used in ChatGPT.
Fail - M6No gatekeeping
Developer mode (custom MCP tools) requires a paid plan, and agent mode and some other capabilities are tier-gated; GPTs shared in the GPT Store are subject to OpenAI usage policies and review.
Fail
Controllable · Is your word final?
50%- C1Communication boundaries
Owners limit channels by choosing which apps and connectors are enabled, but cannot set which recipients, domains or peers the agent may contact, and no enforcement below the model is documented.
Partial - C2Approval gates
Agent mode asks for confirmation before consequential actions such as purchases, and uses watch mode on sensitive sites. OpenAI describes the confirmation behaviour as trained model behaviour, and owners cannot choose which actions are gated.
Partial - C3Immediate halt
Owners can stop an agent task or response at any time from the interface, and can take over the agent's browser.
Pass - C4Data sovereignty
All content is processed on OpenAI servers. For consumer plans, 'Improve the model for everyone' is on by default, so training is opt-out rather than opt-in.
Fail - C5Credential custody
OAuth tokens for apps and connectors are held by OpenAI. Owners can disconnect apps, which revokes access, but cannot inspect the tokens or take them to another runtime.
Partial - C6Full deletion
Owners can delete chats, memories and their account, and OpenAI states data is removed within 30 days unless legal or security obligations require longer retention. Data already used for training is not removed from models, and court-ordered preservation has previously extended retention.
Partial
Vendors and the public can dispute any finding with evidence. Disputes and their resolutions are published.