OpenAI held its DevDay on September 29 in San Francisco, and its own announcement page calls it the biggest event the company has run. That's the kind of line you'd normally skip past, but this time the agenda backs it up. The headline feature is Dots, a persistent agent that keeps working on a task after you close your laptop, running on its own dedicated machine instead of borrowing your session for a few seconds at a time. Put that next to Cursor's Projects and the Agents API OpenAI shipped back in September, and a pattern that's been building all year finally has a name. The pitch stopped being "a smarter autocomplete" months ago. Now it's a coworker who doesn't need you in the room, and three separate companies have shipped infrastructure for exactly that in the last few weeks.
The model news is almost a footnote by comparison, which tells you something on its own. GPT-6.1 Sol is pitched as getting close to Astra's capability at roughly a fifth of the price, the kind of release that used to be the whole keynote and is now one slide among many. The Agents API picked up computer use, so an agent built on it can click through a real interface instead of only calling an API, and OpenAI says its new Ultrafast mode pushes generation up to eight times faster in Codex and six times faster through the API. None of that is small. It's just not the story anymore, because the story has moved from "can the model do the task" to "can you leave it alone long enough to get value out of that."
The part worth actually sitting with is the pricing. OpenAI reopened its $200 Pro tier to new subscribers and stacked a $500-a-month Pro 500 plan on top, aimed at people running agents all day rather than firing off the occasional prompt. A consumer chatbot company doesn't introduce a $500 tier by accident. It's a plain signal about who OpenAI now thinks its serious customer is, and it isn't the person asking ChatGPT to summarize an email. If you're budgeting AI tooling as a line item rather than a curiosity, this is the tier that's going to show up on next year's invoice, and it's worth deciding now whether your workload needs it or whether you'd just be paying for headroom you won't touch.
Private Intelligence, previewed for later this fall with no ship date attached, is the one I'd watch rather than react to right now. The pitch is stronger data controls while keeping frontier-model capability, which is exactly the gap enterprise buyers have been complaining about since agents started touching real company data. A preview isn't a feature yet. But it's OpenAI admitting, in public, that "trust us with your data" hasn't been a good enough answer for the customers it actually wants, and that's worth remembering the next time a vendor asks you to wire an agent into production systems on the strength of a blog post and a promise.
Meanwhile, with a lot less fanfare, Next.js shipped its scheduled September security release on September 30, patching nine vulnerabilities across versions 16.3.7 and 15.5.27, one of them critical. Vercel had announced the release window a week ahead of time under its monthly security program, which is a genuinely good practice more frameworks should copy. Knowing a patch is coming on a specific date beats finding out a CVE existed after someone already used it against you. But advance notice only helps if you act on it once it lands, and a critical-severity fix sitting unpatched in the framework rendering your production pages isn't a "get to it next sprint" item. If you're running Next.js 15 or 16 and haven't pulled the latest patch version yet, that's the one thing from this week worth stopping to do today. Everything else here can wait until Monday.