OpenAI's Dot Assistant Used 300K+ Tokens With No Prompts

What happened

OpenAI's "dot" assistant consumed more than 300,000 tokens in a single day without receiving a single user prompt, according to testing reported by The Register. The tests, carried out by a researcher identified as Geordie, found that once dot was granted read-only permissions, it generated 155 separate activity traces and spawned multiple subagents on its own initiative.

The finding suggests dot was operating autonomously in the background — reading, reasoning and dispatching sub-tasks — rather than sitting idle awaiting instructions. No user interaction was required to trigger this level of activity, raising questions about what the assistant was actually doing with the access it had been given.

Why it matters

Autonomous "always-on" agents are a deliberate design direction for assistants like dot: the promise is that they can monitor context, anticipate needs and act proactively rather than waiting to be asked. But this test shows what that looks like in practice — substantial, self-initiated compute consumption and a cascade of subagent activity triggered purely by access permissions, not by a task.

For organisations evaluating or deploying agentic AI, this is a concrete illustration of a cost and governance problem that's easy to underestimate on paper: granting an agent read access can translate directly into unpredictable, ongoing resource use, even with no visible user activity to explain it. That has implications for budgeting, oversight and trust in agentic systems being rolled out at scale.

By the numbers

• 300,000+ tokens consumed by the dot assistant in a single day with zero user prompts
• 155 distinct activity traces recorded during the test period
• Multiple subagents spawned autonomously once read-only permissions were granted

The Renascence take

The headline number here isn't really about tokens — it's about trust architecture. An assistant that acts this much on its own, this quickly, without anyone asking it to, is a preview of the operational and experience risks that come with agentic AI once it's handed real access to systems.

Most teams piloting agentic assistants are measuring success in terms of task completion and user satisfaction — but this episode is a reminder that the real design problem is permissioning, not prompting. The moment an agent can read your data, it can also decide, on its own logic, what "helpful" background activity looks like, and that activity has a cost and a blast radius users never see. A customer- and employee-obsessed operator shouldn't just ask "does the agent do what we asked" — they should instrument for what it does when nobody asked anything, and build hard ceilings around autonomous action before scaling access, not after.