OpenAI's bots

OpenAI documents four bots on its crawler overview. GPTBot collects public pages that may be used to train models, OAI-SearchBot indexes pages for ChatGPT search, ChatGPT-User fetches a page live when a ChatGPT user, Custom GPT or GPT Action asks for it, and OAI-AdsBot checks the landing pages of ads shown in ChatGPT. The oldest is ChatGPT-User, which arrived with ChatGPT plugins on Mar 23, 2023, and GPTBot followed on Aug 7, 2023.

Site owners see a lot of this traffic. In Cloudflare Radar data for July 2026, GPTBot made up 9.7% of AI-bot traffic, ahead of OAI-SearchBot at 1.6% and ChatGPT-User at 1.3%, and Cloudflare found that ChatGPT-User requests grew 2,825% from May 2024 to May 2025 while GPTBot requests grew 305%. GPTBot was also the AI bot most often disallowed in robots.txt among top domains in June 2025. Publishers want to decide what feeds training and what feeds search, and since Dec 9, 2025 OpenAI's docs say robots.txt rules may not apply to ChatGPT-User, because a person started the fetch.

How OpenAI's bots show up on your site

All four are server-side HTTP fetchers that run from fixed IP prefixes OpenAI publishes in one JSON file per bot. On Nov 1, 2026 the ChatGPT-User list held 235 prefixes, OAI-SearchBot 39, GPTBot 18 and OAI-AdsBot 2, and the ChatGPT-User list changes often. Each request carries a short token with an openai.com link, such as GPTBot/1.4 or ChatGPT-User/1.0.

Why OpenAI's bots are easy to detect

Every bot names itself, and the IP lists let you reject anyone who borrows the name, so a user agent match plus an IP lookup settles most cases. The catch is ChatGPT-User, which may skip robots.txt and needs a firewall rule if you want it gone. OpenAI also says GPTBot and OAI-SearchBot may share a single crawl, while robots.txt still treats them separately.

These checks also stop at OpenAI's agent products. OpenAI's cloud browser, which drove ChatGPT agent until OpenAI removed that product in early Aug 2026, uses a normal Chrome user agent rather than any of these tokens, and OpenAI's allowlisting guide says it signs every request with Web Bot Auth under Signature-Agent: "https://chatgpt.com". Across sites that use Verisoul, from Oct 29 to Nov 1, 2026 (Nov 1 partial), that cloud browser made up 13% of the personal-agent sessions we named, on about 40% as many customer sites as Meta's Muse, which is why we name it separately as chatgpt_agent.

How Verisoul detects OpenAI's bots

These bots are self-declared, so Verisoul starts from the token in the user agent and then confirms the source IP belongs to OpenAI's own network. A token that passes both checks is named, while a token from any other network is treated as a spoofer rather than as OpenAI.

"agent": {
  "id": "gptbot",
  "name": "GPTBot",
  "provider": "OpenAI",
  "type": "ai_crawler",
  "detection_method": "self_declared",
  "detection_signals": [
    "network",
    "behavioral"
  ]
}

• id is the bot, here gptbot, and the others come back as oai_searchbot, chatgpt_user and oai_adsbot
• type is ai_crawler, which separates read-only crawlers from agents that act on a page
• detection_method is self_declared, because the bot named itself in its user agent
• detection_signals is network, meaning the source IP was confirmed as OpenAI's own

Each bot has its own Agent Atlas entry, and the AI agent detection docs list every id the API returns.

How to detect OpenAI's bots step by step

1. Turn on Verisoul and read the agent object in the API response
2. Allow or block gptbot, oai_searchbot, chatgpt_user and oai_adsbot one by one to match your content policy
3. Set robots.txt for GPTBot and OAI-SearchBot separately, for example block training and allow search
4. Treat any OpenAI token that fails the IP check as a spoofer and handle chatgpt_agent with its own rule

Should you block OpenAI's bots?

These bots read content and never sign up or pay, so whether to allow them is a content decision rather than a fraud one. Many teams allow OAI-SearchBot and ChatGPT-User for visibility in ChatGPT, decide on GPTBot by training policy, and block any OpenAI token that fails the IP check.