What is ChatGPT-User, and when does it visit your site?

ChatGPT-User is not a person using ChatGPT, and it is not an account: it is the name the agent OpenAI sends introduces itself with on your server when someone, from ChatGPT, triggers a visit to a site. Unlike a crawler, it does not follow links on its own or keep an index. For a store it has two consequences. It is the most direct trace that a person is using ChatGPT with one of your pages, and it is the OpenAI agent that leaves you the least control through robots.txt.

How it works

OpenAI documents three agents on the same page and gives them different jobs. OAI-SearchBot is the search one, GPTBot is the one that gathers content to train its models and ChatGPT-User is the one it uses for certain user actions in ChatGPT and in custom GPTs.⁠^{[1]OpenAI. Overview of OpenAI Crawlers} The documentation does not list those actions; what it does make clear are three limits:⁠^{[1]OpenAI. Overview of OpenAI Crawlers}

• It does not crawl the web automatically. Each visit answers something a person has done.
• It does not decide what appears in ChatGPT search. OpenAI expressly says ChatGPT-User is not used to determine whether content can appear in its search.
• robots.txt may not apply. Because the action is initiated by a user, the file's rules may not apply to these visits.

That last point is the one that surprises people most, and there is a reason for it. The Robots Exclusion Protocol, published as RFC 9309, is designed for crawlers: programs that decide on their own what to request. And even for them, the standard reminds us that its rules are not a form of access authorization.⁠^{[2]IETF (Koster, Illyes, Zeller and Sassman). RFC 9309: Robots Exclusion Protocol} A User-agent: ChatGPT-User group in your file is a request, not a closed door, and OpenAI already warns it may not honor it.

The request arrives with this user agent, in the version OpenAI documents as of October 2026:⁠^{[1]OpenAI. Overview of OpenAI Crawlers}

Mozilla/5.0 AppleWebKit/537.36 (KHTML, like Gecko); compatible; ChatGPT-User/1.0; +https://openai.com/bot

Anyone can type that string into a request, so the name proves nothing. What does prove it is the source address: OpenAI publishes the IPs ChatGPT-User comes from at openai.com/chatgpt-user.json.⁠^{[1]OpenAI. Overview of OpenAI Crawlers} The version we read on October 6, 2026 was dated September 25, 2026 and had 230 IPv4 prefixes, many more than the lists for its other two agents.⁠^{[3]OpenAI. chatgpt-user.json (ChatGPT-User IP ranges)} A list like that moves, and you check it the day you verify, you do not copy it once.

The other companies have their equivalent, and they do not treat it the same way. Perplexity uses Perplexity-User for the actions a person requests inside its search engine, and says it generally ignores robots.txt rules because a user asked for the visit.⁠^{[4]Perplexity. Perplexity Crawlers} Anthropic, by contrast, states that its agents respect robots.txt directives, and warns that blocking Claude-User stops Claude from retrieving your content to answer a question, which may reduce your visibility in user-directed searches.⁠^{[5]Anthropic. Does Anthropic crawl data from the web, and how can site owners block the crawler?} Three companies, three policies for the same kind of visit.

OpenAI documents separately another agent that should not be mixed up with this one: ChatGPT Work's cloud browser. That agent signs every request with the HTTP Message Signatures standard (RFC 9421), with a Signature-Agent header whose value is "https://chatgpt.com", and OpenAI publishes the keys to check the signature.⁠^{[6]OpenAI Help Center. ChatGPT Work's Cloud browser allowlisting} It is the Web Bot Auth approach. The ChatGPT-User page does not mention signatures: for this agent, the verification OpenAI documents is the IP list.⁠^{[1]OpenAI. Overview of OpenAI Crawlers}

In a store

A specialty coffee store checks its server logs one morning. It is a fictional example, simplified and with IPs reserved for documentation:

198.51.100.20 [06/Oct/2026:10:02:11 -0400] "GET /products/ethiopia-coffee-250g HTTP/1.1" 200 "...compatible; OAI-SearchBot/1.4..."
203.0.113.58  [06/Oct/2026:17:45:30 -0400] "GET /products/ethiopia-coffee-250g HTTP/1.1" 200 "...compatible; ChatGPT-User/1.0..."

The two lines request the same product page and say different things. The first is OpenAI's search agent passing through the store: your page may get into what ChatGPT shows in its searches. The second is a one-off visit tied to a person's action in ChatGPT.⁠^{[1]OpenAI. Overview of OpenAI Crawlers} Neither proves the page shows up in an answer, and both deserve the same check before you count them: the first's IP is checked against the OAI-SearchBot list, and the second's against chatgpt-user.json.

Now suppose the store wants ChatGPT not to read its catalog and adds this to its robots.txt:

User-agent: GPTBot
User-agent: ChatGPT-User
Disallow: /

For GPTBot the rule works as OpenAI describes: it signals that content should not be used to train its models.⁠^{[1]OpenAI. Overview of OpenAI Crawlers} For ChatGPT-User it is another matter. OpenAI does not promise to honor it, because each visit is requested by a person,⁠^{[1]OpenAI. Overview of OpenAI Crawlers} so the store cannot take for granted that the second log line stops appearing. The only thing worth checking afterward is exactly that: whether it appears or not, with the IP verified.

How to check it

1. Look for ChatGPT-User in your server or CDN logs and note which pages it requests and at what times. These are one-off visits, not a walk through the site.⁠^{[1]OpenAI. Overview of OpenAI Crawlers}
2. Check each IP against openai.com/chatgpt-user.json the same day you review the logs. If it is not on the list, it is not one of the addresses OpenAI declares for this agent.⁠^{[3]OpenAI. chatgpt-user.json (ChatGPT-User IP ranges)}
3. Tell OpenAI's three agents apart by name before drawing conclusions: OAI-SearchBot for search, GPTBot for training and ChatGPT-User for a person's actions. Each has its own IP list.⁠^{[1]OpenAI. Overview of OpenAI Crawlers}
4. Read your robots.txt knowing what it can do. If it has a group for ChatGPT-User, do not assume it is honored: OpenAI warns it may not apply.⁠^{[1]OpenAI. Overview of OpenAI Crawlers}
5. If you use a firewall or a CDN that filters bots, check what it does with these IPs. If it blocks them, ChatGPT will not be able to open your product pages when someone asks, even if robots.txt allows it.

Related concept: OAI-SearchBot

Both belong to OpenAI and both may request the same product page on the same day, but they do not do the same job. OAI-SearchBot crawls on its own to show sites in ChatGPT's search results, is managed in robots.txt, and sites that block it do not appear in that search's answers. ChatGPT-User does not crawl, does not count toward search and answers what a person asks, with the warning that robots.txt may not apply.⁠^{[1]OpenAI. Overview of OpenAI Crawlers} The first says your store is on the search radar; the second, that someone has just used one of your pages in a conversation.

To go further, the guide to what an AI crawler sees in your store goes through what each agent reads, agent by agent, and the reading path for this topic orders the rest of the terms.