The promise of an always-on AI assistant is that it keeps working when its owner is not asking questions. A test of OpenAI’s Dot shows how quickly that promise can become an accounting and oversight problem. The Register reports that one Dot used by AI security and governance firm Geordie generated 155 separate activity traces and consumed about 307,000 tokens in a day without further human interaction.

Geordie’s test did not give the agent broad authority. Hanah-Marie Darley, the firm’s chief AI officer, said Dot had read-only permissions and was not connected to her personal applications, email or Slack. Even inside that limited environment, the agent began researching what it could access, surveying systems and gathering information into a continuously updated journal-like record.

Several abstract subagents inspect generic code repositories behind a read-only permission gate.
Geordie gave Dot read-only access, yet the agent still launched background research and subagents.

The activity was not simply a scheduled job checking in at fixed intervals. According to Darley, Dot initiated work and created subagents without a new user prompt or a persistent task established by the user. OpenAI’s Dots operate with a primary agent that interacts with the user and a secondary agent that runs in the background, and they can create additional short-lived agents for specific work.

That architecture produced bursts of activity that would be difficult for an ordinary user to follow. Of the 155 traces Geordie recorded, at least 50 occurred within two minutes, while most happened within a couple of hours. In a development environment, one subagent checked code repositories and another inventoried the data it encountered, The Register reported.

The significant issue was not that the agent had escaped its permissions. Geordie’s account instead points to a visibility gap inside the work those permissions allowed. Darley said the user would not know that subagents were operating, how they obtained access from the parent agent, or what tasks they had been assigned. An assistant can therefore remain technically within its authorization while still being opaque about the amount and purpose of its background activity.

Hidden background task lines continue consuming compute while a user workspace sits idle.
The test highlights a visibility gap between granted permissions and unseen autonomous activity.

The 155 traces consumed roughly 307,000 tokens. Darley estimated that about 200,000 tokens from a Dot using OpenAI’s Astra model could cost between $5 and $10, although the article stressed that real prices vary with location, subscription plans, discounts and other terms. Token volume also does not map neatly to business value: a small request can be more useful than a much larger one.

That uncertainty complicates budgeting for persistent agents. Spending is straightforward to explain when a person submits a request and receives a result, but background agents can use compute while collecting context, checking their own tasks and launching research that no person explicitly requested. Geordie’s single test does not establish typical Dot usage, yet it illustrates why organizations may need activity logs and spending controls designed around autonomous work rather than human prompts.

Darley expects employees to bring personal agents into workplace systems just as they adopted chatbots and coding assistants. Her advice was not to avoid the technology, but to limit what it can reach: do not give an agent personal information that would be unsafe to send by email, she told The Register, and do not connect real payment cards. The broader lesson from Geordie’s test is that permission settings alone may not answer two basic questions about an always-on agent: what is it doing, and what is that work costing?