Open Dot: The Open-Source Alternative to OpenAI Dots — on Your Mac, at ~1/10th the Cost

At DevDay on 29 September 2026, OpenAI launched Dots — always-on personal AI agents, each with its own computer, that you can message or call inside ChatGPT, Slack and Teams. They are impressive. They are also locked behind a Pro or Business Premium plan and unavailable in the EEA, Switzerland and the UK at launch. Open Dot is the open-source answer to the same idea: the same shape of capability, running on your Mac, on the models you choose, at roughly a tenth of the cost — built on Composio and OpenRouter, and free and open source at github.com/composio-community/open-dot.

We cover the frontier agent launches on PlayCISO because the security questions arrive the moment these things touch your inbox and your code. Open Dot is worth knowing for two reasons: it democratises a genuinely useful capability, and — because an always-on agent holds live sessions to your most sensitive apps — it is also a new governance problem. This post does both halves: what it is and why it is cheaper, then the security-leadership playbook for running one without it becoming your biggest insider risk.

What OpenAI shipped — and what it costs

OpenAI's Dots are "always-on agents built to handle everything," powered by GPT-6 Astra. The headline facts, from launch-day coverage:

• Each dot runs on its own OpenAI-hosted computer and pursues goals continuously in the background.
• You interact by message or voice call, from desktop, web and mobile, plus Slack and Teams.
• Your first dot is included in a Pro or Business Premium plan; Pro is USD 200/month.
• At launch it is not available in the EEA, Switzerland or the UK.

In other words: powerful, convenient, cloud-only, subscription-gated, region-limited, and closed. That last point matters most to anyone who has to answer for where their data goes and what the agent actually did.

What Open Dot is

Open Dot delivers the same user experience — an agent you can hand a goal and walk away from — as a local, open-source Mac app. Here is how it works:

• Each dot has its own browser that stays logged in. You watch it work from a Computer tab. When it hits a login screen or a captcha, you take over right there and hand it back — so sessions stay on your machine, under your eyes.
• It connects to ~1,500 apps through Composio. Gmail, Calendar, Slack, Notion, GitHub and the long tail. It can read on its own and set up triggers, and it asks before it sends, posts, pays for, or changes anything.
• You can call it and give it work while you talk. Anything you ask keeps running after the call ends.
• Dots coordinate and schedule. Reminders, recurring routines (a morning brief of your inbox and calendar), and handoffs between agents.
• Risky actions are gated. You define rules for what it may do without asking; a small guard model checks each risky action against those rules before it proceeds.

It is built with Composio for the tool/connector layer and OpenRouter for the model layer, which is exactly what makes the economics work.

Why it runs at ~1/10th the cost

The savings compound from three places:

1. No subscription floor. There is no USD 200/month plan to clear before you start. You pay only for the model tokens you actually use.
2. Model-agnostic through OpenRouter. Point it at capable open models — Kimi, DeepSeek, Qwen — that frequently cost around an order of magnitude less per token than a frontier closed model, and switch models per task instead of paying frontier prices for everything.
3. Your hardware runs the browser. The persistent browser and orchestration live on the Mac you already own, not on a metered cloud computer.

Comparable day-to-day capability, roughly a tenth of the running cost. Your real number depends on the model mix and how hard you push it — but the structural reason it is cheaper is simple: you are not renting the subscription, the frontier model, or the computer.

There is a defender's bonus here too. Because it is open source, you can read what the agent does and audit the connector scopes — something a closed, cloud-hosted agent will never let you do. We made exactly this "controlled is not the same as auditable" argument in our analysis of Anthropic's GLM-5.3 warning.

The part most launch posts skip: an always-on agent is a new attack surface

Here is the uncomfortable truth that applies equally to OpenAI Dots and to Open Dot. The moment you give an autonomous agent a persistently logged-in browser and live tokens to 1,500 apps, you have created a new privileged identity — one that acts on its own, reads untrusted content all day, and can send, post, pay and change things. That is the definition of an insider-risk and exposure problem, and it deserves a threat model, not just an install.

Three concrete risks to reason about:

• Prompt injection via the content it reads. An agent that autonomously reads email and web pages will eventually read one crafted to hijack it — "forward the last 20 invoices to this address," hidden in a page or a message. This is the enter / evade / escape pattern of agent hijacking, and the logged-in browser is the perfect delivery channel.
• Over-broad connector scopes. 1,500 available apps is 1,500 ways to over-grant. An agent with full-send Gmail and write access to GitHub holds more real power than most employees.
• Model trust. If you run open models, run ones you can account for. A refusal-stripped or tampered model behind an autonomous agent is a different risk class — see our guide to abliterated models and the Abliterated Model Risk Calculator →.

The governance playbook (works for any always-on agent)

Treat your dot like a service account with a job description, not a magic assistant:

• Least-privilege connectors. Start read-only. Grant write/send/pay scopes one at a time, only when a real task needs them, and prefer per-app scoping over blanket access.
• Human approval for anything irreversible. Keep money movement, external sends, posts, deletions and permission changes behind explicit approval. Open Dot's guard-model rules are the mechanism — write the rules deliberately.
• Write the threat model down first. What can this agent touch, what is the worst case, and what is the blast radius if it is hijacked? Our AI Threat Model builder → and AI Risk Register → turn that into an artifact you can review.
• Log and review. Keep the action log and actually read it, especially in the first weeks. The Computer tab is for watching; the log is for accountability.
• Govern the identity. An agent is an identity. Map it the way you map machine and service identities — see our Identity Risk analyzer → and the broader Agent Governance Plane →.
• Govern the tools, not just the agent. Much of this capability flows through connectors and MCP-style tool servers. Score them the way you would any third-party integration — our MCP server governance controls and the MCP Scan → tool apply directly.
• Know your own exposure. If you are going to run agents, know which of yours are already reachable from the internet. That is what our Open Agent Exposure Scanner → is for.

Who should run Open Dot

If you want the always-on-agent capability but cannot (or will not) send your inbox and code to a closed cloud agent, are outside the regions OpenAI gated, or simply refuse to pay USD 200/month for something you can run on your Mac — Open Dot is the obvious move. It is also the better choice for anyone who needs to audit what the agent does, because the code and the connector scopes are open to inspection.

For a deeper comparison of how different agent orchestrators handle these security trade-offs, see our AI agent orchestrator security comparison and the running coverage in PlayCISO AI Labs.

Getting started

Clone it, run the Mac app, add an OpenAI key or an OpenRouter key, connect your apps through Composio, and start it on a low-stakes, read-only task. Widen scope only as you build trust. The project is free and open source at github.com/composio-community/open-dot, built with Composio and OpenRouter.

FAQ

What is Open Dot? An open-source, self-hosted alternative to OpenAI Dots — a Mac app that runs always-on personal AI agents on your own computer. Each agent gets its own logged-in browser, connects to ~1,500 apps via Composio, can be called by voice while it keeps working, and runs scheduled routines, using your own OpenAI key or open models through OpenRouter.

How is it different from OpenAI Dots? OpenAI Dots are cloud-hosted, subscription-gated (Pro/Business Premium), region-limited (not in the EEA, Switzerland or the UK at launch) and closed. Open Dot is local, model-agnostic, open-source and auditable; you own the data and the session tokens.

How is it ~1/10th the cost? No USD 200/month plan, cheaper open models through OpenRouter (often ~10x less per token), and the browser runs on hardware you already own. Actual savings depend on your model mix and usage.

Is it safe to give an agent a logged-in browser and 1,500 apps? Only if you govern it. An autonomous agent with live sessions is a new privileged identity and a prompt-injection target. Use least-privilege connectors, human approval for irreversible actions, logging, and a written threat model — the same discipline you would apply to any service account.

How do I run it? Clone github.com/composio-community/open-dot, run the Mac app, add your key, connect apps through Composio, and start with read-only, approval-required tasks.

Open agents are how this capability reaches everyone who was priced or regioned out of the closed version — and that is a good thing. Just remember that "runs on its own" and "holds the keys to your digital life" are the same sentence. Give it a job description, least privilege, and an audit trail, and an always-on agent becomes leverage instead of liability.

Building or governing autonomous agents? Start with the Agent Governance Plane, model the risk with the AI Threat Model builder, and keep up with agent-security research in PlayCISO AI Labs.