OpenAI's dots browse websites for people. Is yours letting them in?

OpenAI's dots browse websites on their own

OpenAI launched dots on September 29, 2026, inside ChatGPT, for Pro and Business Premium users in eligible markets. A dot is built to keep working on a goal a person sets, in the background, with little oversight. Each one lives in the cloud and has its own computer and its own web browser.

That last part is the one that touches your shop. The visitor on your site may not be a person on a phone. It may be a browser in a data center, opened by a dot, reading your pages for someone who asked it a question.

If your hours page or your menu will not load for that browser, whatever the dot brings back to its person will not include them. Nobody tells you it happened. You just do not get the visit.

Bloomberg says Apple wants Siri to work the same way

According to Bloomberg's report, Apple could make Siri work more like an agent as early as next year, which means 2027 on Bloomberg's timeline. Cult of Mac, writing about the report, counts dots among the rivals that already go further than Siri.

Keep that in proportion. Siri today mostly waits to be told what to do, instead of working toward a goal on its own in the background. Apple has not announced agent features for Siri, and it has not given a date for them.

So the Siri part is a report, not a release. It is still worth a few minutes of your week, because of where it points. If the assistant already on your customers' phones starts visiting websites for them, these visitors stop being a niche.

Why robots.txt may not keep these visitors out

If someone set up a robots.txt file for your site to keep crawlers off certain pages, it may not cover this kind of visitor. OpenAI says its visitor called ChatGPT-User handles actions a person starts in ChatGPT. Because a person started those actions, OpenAI says robots.txt rules may not apply to them.

That page is about OpenAI's own visitor, and it does not name dots. Cloudflare describes the same kind of visitor as a personal agent, a tool that acts for a person, fetching information or browsing when that person asks.

The practical point cuts both ways. A line in a text file may not keep these visitors out. And a setting in front of your site may be turning them away without you ever having chosen that.

The Cloudflare setting that changed on November 4

If your site sits behind Cloudflare, this part is yours. If you do not know, the person or company that hosts your site can tell you in one email.

On November 4, 2026, Cloudflare renamed its setting Configure AI bot policies to AI Crawler and Agent access policies. The same change lets site owners set rules for the top Personal Agents one by one.

In the Cloudflare dashboard, the setting sits under Security, then Settings, then AI Crawler and Agent access policies. There, Agent traffic means automated activity acting in real time for a person. The choices for it include Block, Block on pages with ads and Allow (do not block). Personal Agents follow your general Agents rule unless you change them one by one.

Which choice fits your business

There is no single right answer, and the setting does not choose for you. Think about what a person would send a dot to find on your site.

• A bakery or a restaurant wants its hours and its address read by anything that asks. Allow is the plain choice there.
• A salon or a dental office wants the booking page and the prices reachable. Same answer.
• A site that earns money from ads may want to look at Block on pages with ads first.
• A law office may be happy to let the contact page through, and still keep client documents behind a login.

Blocking is a choice too. Just make it on purpose, not by leaving a setting you never opened.

Check what a visitor with no login sees

The Cloudflare setting is one gate. A sign-in wall, or a page that asks the visitor to prove they are human, is another.

Open your hours page, your menu and your booking page in a private window on your phone, with no login. If any of them asks you to sign in, or makes you prove you are human before it loads, a dot's browser is likely to meet the same wall. Fix that, or decide you are fine with it.

What to do

1. If your site sits behind Cloudflare, open Security, then Settings, then AI Crawler and Agent access policies.
2. Read the Agents rule and write down whether it says Block, Block on pages with ads or Allow (do not block).
3. Decide whether the top Personal Agents should follow that rule, since they do unless you change them one by one.
4. Open your hours, menu and booking page in a private window with no login, and confirm each one loads without a sign-in or a challenge page.
5. If your site is not on Cloudflare, email whoever hosts it and ask one question: do you block visitors that browse for a person?

Every site Your Wish Is Our Code builds ships with its search and answer-engine baseline, and the websites page says what that includes.