It worked while you slept — OpenAI shipped always-on agents, and the AI Act duty that reaches them is already in force

OpenAI's DevDay on 29 September 2026 shipped dots, always-on agents on their own cloud computers reaching over 4,000 apps through plugins, alongside GPT-6.1 Sol at a fifth of Astra's token prices, Ultrafast at 300 tokens per second, and computer use in the Agents API. The launch-day framing of an agent that telephones and writes to people does not survive OpenAI's own limits page, which states that a dot cannot initiate calls at launch and confines texting to Pro users in the United States — so the transparency exposure is not the shipped consumer product but the outbound agent a developer can now build on the Agents API in an afternoon. The regulatory correction is which chapter the Digital Omnibus moved: Regulation (EU) 2026/1744, in force 27 July 2026, deferred Annex III high-risk to 2 December 2027 and Annex I to 2 August 2028, and did not touch Article 50, whose transparency duty has applied since 2 August 2026 and whose machine-readable marking limb applies from 2 December 2026, 63 days out. Article 50(1) is a design duty on the provider, Article 50(5) makes it due at the latest at the first interaction, and in Germany the KI-MIG has been in force since 29 July 2026 with the Bundesnetzagentur as central market-surveillance and coordination authority under a hybrid model that leaves fully harmonised product areas with sector regulators.

Post

Your agent's own cloud computer was working at 3am. Nobody was watching it. That is a product now, not a thought experiment.

Yesterday at DevDay, OpenAI shipped dots: always-on agents that run on their own cloud machine, keep working while you are elsewhere, and reach over 4,000 apps through plugins.

Flat:

  1. Dots run on GPT-6 Astra, rolling out to Pro and Business Premium "in eligible markets". GPT-6.1 Sol arrives at a fifth of Astra's input and output token prices with "exceptionally strong performance on agentic coding". Ultrafast tops out at 300 tokens per second — 8x in Codex, 6x in the API. The Agents API now does computer use.

  2. Before you file dots under "an AI that phones people": it doesn't. OpenAI's own help page says "Your dot cannot initiate calls to you at launch" — to you, its owner. Texting is limited to Pro users in the US. The coverage is ahead of the product. The disclosure problem is not OpenAI's dot. It is the outbound voice agent you can now build in an afternoon on the Agents API.

  3. And if your instinct is that the AI Act gave you until 2027 — check which chapter moved. The Digital Omnibus, Regulation (EU) 2026/1744, in force since 27 July 2026, pushed Annex III high-risk to 2 December 2027 and Annex I to 2 August 2028. It did not touch Article 50. Transparency has applied since 2 August 2026, and machine-readable marking of synthetic audio, image, video and text lands 2 December 2026. That is 63 days. In Germany the KI-MIG has been in force since 29 July 2026 and the Bundesnetzagentur is the central market-surveillance and coordination authority, so the enforcer has a name.

Monday:

  1. Article 50(1) is a design duty on the provider — whoever builds the system. If you built it, that is you, not your model vendor.
  2. Disclosure is due "at the latest at the time of the first interaction" (Article 50(5)). First turn, not a footer.
  3. "Unless this is obvious" is not a waiver you assert. Write down why, or say it.
  4. Marking has a date on it. Put 2 December in the sprint that reaches it.

An always-on agent is a product decision. Disclosure is a design duty, and it is already in force.

Which of your agents tells anyone what it is?

#AgenticAI #EUAIAct #AIGovernance #DevSecOps #SoftwareEngineering

First comment

Sources, primary where one exists.

The full DevDay 2026 announcement list, OpenAI's own: https://openai.com/index/devday-2026-recap/

The dots announcement — always-on, own cloud computer, 4,000+ apps, "eligible markets": https://openai.com/index/introducing-dots/

The help page that contradicts the coverage — no outbound calls at launch, texting US Pro only: https://help.openai.com/en/articles/20001530-getting-started-with-your-dot

Article 50 in full: paragraph 1 on providers, 2 on machine-readable marking, 5 on timing: https://artificialintelligenceact.eu/article/50/

The implementation timeline, for which chapter the Digital Omnibus actually moved: https://artificialintelligenceact.eu/implementation-timeline/

Cut for length: Codex Security Cloud now scans whole GitHub repositories on a schedule, and plugins can start automations from MCP Events when something happens in a connected app. That is the same disclosure question one layer down — an agent woken by an event has no first interaction a human is present for.

Claims

Sources

Corrections

Dropped before drafting: an AWS Bedrock AgentCore story. Infosecurity Magazine dated the BeyondTrust write-up 28 September 2026, but the AWS security bulletins for CVE-2026-12530 and CVE-2026-16796 are dated 17 June and 23 July 2026 and the BeyondTrust posts are from June 2026. A coverage date is not an event date; the item was three months old.

Tightened before publication: an earlier draft said "BNetzA is the market surveillance authority". The Bundesnetzagentur's own 29 July 2026 release describes a hybrid model in which it is the central coordination and competence centre and the market surveillance authority for radio equipment and named sensitive sectors, while established sector regulators keep fully harmonised product areas. The line now says "central market-surveillance and coordination authority".

AI disclosure

The video for this edition contains AI-generated media: the narration is a synthetic voice, the cover art and any background imagery are generated, and the brand ident animation is generated. The script, the claims and the source verification are human-authored and human-checked. Assets carry IPTC DigitalSourceType and C2PA Content Credentials.