Brands Get Their Own Agents Inside ChatGPT, Perplexity Ships Always-On Teammates, and CrowdStrike Watches Agents Like Insiders

Three launches from the past ten days point the same way: agents are moving out of one-off chats and into roles that persist. One puts a brand's own agent inside ChatGPT, one gives a user agents that never close their thread, and one treats agents as insiders that need watching. Details come from announcements and trade coverage, much of it written on launch day, so treat specifics as provisional.

1. Your Support Bot May Now Live Inside Someone Else's Chatbot

On November 10, OpenAI opened Businesses in ChatGPT in beta. Coverage describes three parts: a claimable business profile, a Business Hub with reporting such as mention and click counts, and Business Agents that answer customer questions inside ChatGPT. Profiles are reportedly open to eligible businesses wherever ChatGPT is available, but agents are limited for now to eligible US ecommerce and online service businesses, and verifying a business doesn't automatically qualify it to publish one. Agents are labeled and kept separate from ChatGPT's own answers, publishing one is reported to be free at launch, and a business can sponsor its agent as the destination for ChatGPT Ads. Eligibility for publishers and public bodies, pricing after launch and international rollout are still unsettled, and at least one non-US claim reportedly landed on a waitlist.

For builders this is a new deployment surface you don't control. The conversation starts in ChatGPT, the model around your agent isn't yours, and your agent has to make sense to someone who arrived from an ad or a mention. Keep it grounded in the same source of truth your own site bot uses, and decide up front what it may do versus what it should hand back to your site.

2. Agents That Keep a Job, Not Just a Chat

Perplexity launched Teammates in early November (reports put it around November 5 to 6). Each teammate is a persistent agent that owns ongoing work such as a campaign, bug triage or a research thread. It lives in the sidebar with one thread that never closes, is built on Perplexity Computer, and inherits the user's projects, skills, plugins, memory and permissions. Developers can connect tools such as Slack and GitHub and set triggers that tell a teammate when to act. It is web-only for Max subscribers ($200 a month), with iOS planned and promotional free usage before it draws on Max credits. Perplexity hasn't published failure data, and coverage questions how permissions hold when work is handed off.

Persistence changes the engineering problem. A chat that ends can forget its mistakes; a teammate that runs for weeks accumulates them. Two habits help: scope each trigger narrowly, and write state the agent can be audited against.

type Trigger = { source: 'slack' | 'github'; event: string; scopes: string[] };

const triage: Trigger = {
  source: 'github',
  event: 'issues.opened',
  scopes: ['issues:read', 'issues:label'], // no write to code, no merges
};

// Every run appends to a log a human can review, rather than only to the agent's memory.
async function onEvent(t: Trigger, payload: unknown, log: (e: object) => Promise<void>) {
  await log({ at: new Date().toISOString(), trigger: t.event, scopes: t.scopes, payload });
}

3. Treating Agents as Insiders

At Fal.Con Europe on November 4, CrowdStrike announced Agent Insider Threat Detection for Falcon Next-Gen SIEM, slated for Q4. Per the company and trade coverage, it learns the normal behavior of each AI agent and its human owner, flags deviations even when no policy rule is broken, and feeds that risk into the score the SIEM already keeps for the owner and host. A response layer includes a kill switch that terminates an agent, and analysts can pause CrowdStrike's own agents mid-task to stop unauthorized actions or runaway spend. CrowdStrike's threat-hunting team says agent-triggered detection leads now arrive at 2.5 times the rate of human-triggered ones on monitored endpoints. These are vendor claims, and the feature hadn't shipped at announcement.

The useful idea is behavioral baselines over static rules. An agent with legitimate credentials that starts reading far more records than usual breaks no rule, but it isn't behaving like itself. If you run agents with tool access, record per-agent tool-call volumes and targets so drift is visible, and keep a stop control that works mid-run.

Conclusion

Agents are becoming long-lived actors: a brand's representative inside a third-party chatbot, a teammate with a standing job, a credentialed insider on the network. Each needs the same things a human in that role would, namely a clear remit, a record of what it did, and someone who can stop it.

Suggested visuals: a diagram of a customer's path from a ChatGPT ad or mention to a labeled Business Agent and back to the brand's site, and a chart of one agent's daily tool calls against its baseline with an anomaly flagged.

— Maya