OpenAI Aura Safety Check Can Block Sites From ChatGPT Browsing

OpenAI Aura, a central site-safety check run by OpenAI, can stop the company’s browsing tools from opening a flagged website, according to a report by Search Engine Journal. The block applies regardless of local settings or robots.txt rules, and the report says there is no public appeal process, which matters for any publisher that relies on visibility in ChatGPT browsing.

• OpenAI’s site-safety check, called Aura in its systems, can stop Codex Browser Use and ChatGPT live search from opening a flagged site.
• A block ignores local user settings and robots.txt rules. There is no public way to learn why a site was flagged or to ask for a review.
• An international media publisher says it has been blocked since May 2026, and all five URLs it tested were still blocked weeks later.
• OpenAI support confirmed a safety block was active. Specialist teams were reviewing whether it was intentional.
• The Aura in this report is not the Aura codename used for Atlas, and the facts say nothing about an Aura app, login or Android version.

What the Search Engine Journal report found

Search Engine Journal describes a centralized safety check for websites that can prevent OpenAI’s browsing tools from opening sites it has flagged. When a site is flagged, the tools refuse to load it, and they do so while ignoring local user settings and robots.txt rules.

OpenAI’s systems and codebase refer to this check as Aura, the report says. The tools affected are Browser Use in Codex and live search in ChatGPT.

The report also states that there is currently no public way to find out why a website was blocked or to ask for a review. A site owner who is flagged therefore has no documented route to learn the cause or to request a second look.

The report centers on the experience of an international media publisher, covered in detail below, whose author says the block has been in place since May 2026.

How the OpenAI Aura check works

The report pieces together the mechanism from network traffic and from statements it attributes to OpenAI engineers. Some parts remain unconfirmed, and the report says so.

One point of naming matters. The report notes that this Aura is not the same as the Aura codename used for Atlas, OpenAI’s AI browser.

The status API and the 24-hour cache

Network traffic shows checks being made to chatgpt.com/backend-api/aura/site_status. That endpoint is where the tools appear to ask whether a given site may be opened.

According to the report, a flagged block decision is saved locally for 24 hours. A block, once returned, is therefore not re-queried on every request during that window.

Fail-open glitches versus strict blocks

The report says OpenAI engineers described two different behaviors. Network glitches during a status check default to allowing access, so a failed lookup does not by itself stop a page from loading.

Explicit site blocks, by contrast, fail closed. They remain strict and override customer allow rules. This is consistent with the report’s finding that local settings do not lift a block.

What a blocked session looks like

Reports on Browser Use describe how an OpenAI Aura block shows up inside the tools. A tab that was already open before the check can still expose its page title and URL, but loading the page content fails, and so does any navigation from it.

The refusal is not always limited to one tab. A blocked site can end the whole agent session, even when the user navigates there by hand instead of letting the agent pick the link. In practice, a task that touches a flagged domain may stop outright, and the user has to start a new session without that site.

The unconfirmed prompt-history theory

The report says requests to the status API send chat details alongside web links. Based on that, some researchers think certain prompt histories might trigger site-wide blocks.

This is unconfirmed. The report presents it as a theory held by some researchers, not as an established cause of any block.

The publisher case – blocked since May 2026

The report’s author says the publisher has been blocked since May 2026 despite open robots.txt rules. All five tested URLs, covering the main site, subdomains and article pages, were still blocked weeks later.

When Browser Use tried to open the site, it displayed a security message: “Browser use is not permitted on [domain].” The message cited the site-safety policy as the reason. No user permission prompt appeared, and no Auto-review was attempted.

Comparison with other sites

The same session loaded two competitor newspaper and magazine platforms without trouble. A third-party page that uses the publisher’s technology, hosted on another domain, loaded as well. The block therefore appeared tied to the publisher’s own domains and not to its technology or its industry.

Crawl traffic figures

The publisher’s website traffic stats showed about 5,000 successful connections served to OpenAI’s training crawlers over the last 30 days. The same stats showed 477,000 for Google and 564,000 for Anthropic, the report states.

OpenAI’s response

OpenAI support staff acknowledged in writing that a safety block was active. They also said specialist internal teams were reviewing whether the block was intentional.

Why robots.txt does not override Aura

A robots.txt file is a file on a website that tells crawlers which pages they may access. Site owners use it to allow or disallow specific bots.

OpenAI lists three agents. GPTBot is a crawler OpenAI says it uses for training generative AI models. OAI-SearchBot is a crawler used for features in search results. ChatGPT-User is a user agent used for direct requests made by users.

OpenAI says the robots.txt settings for OAI-SearchBot and GPTBot are independent of each other, so a site can allow one and disallow the other. After a robots.txt update, OpenAI says it can take about 24 hours for its search systems to adjust, according to OpenAI Developers.

The OpenAI Aura block sits outside these controls. Per the report, a flagged site is refused by Browser Use and live search regardless of robots.txt, so allowing the crawlers does not lift it. That also means the 24-hour adjustment window for robots.txt changes is not a path to resolving an Aura flag.

What site owners and users should take from it

The report says publishers cannot currently diagnose or appeal a block. A ChatGPT browsing block can therefore cost a site its visibility without notice, and open robots.txt rules give no protection against it.

Users of Browser Use or live search may see refusals with no permission prompt, as in the message the report quotes. The refusal cites site-safety policy and does not give a site-specific reason.

ChatGPT’s own settings are a different layer. According to OpenAI’s help pages, a user can have the tools ask before visiting a site they have not opened before, and can keep per-site lists of sites to always allow or always block. Those choices shape what the agent does on your behalf, but they sit below OpenAI Aura. Adding a flagged domain to an allow list does not lift the block, and switching off the ask-before-new-site prompt will not make a refused site load. If a site stays blocked after you allow it, the cause is the central check, not your configuration.

Crawl traffic figures alone do not explain a block. The publisher’s training-crawler numbers were low next to Google and Anthropic, but the report does not establish that traffic levels caused the flag. Its author says their experience contradicts what OpenAI’s help pages suggest about the causes of browsing failures.

Evidence to gather for a support request

Until OpenAI Aura has a public review route, a publisher can still gather evidence for a support request. Four things are worth recording now:

1. The exact refusal text, word for word, as in the ChatGPT site-blocked message the report quotes.
2. The date the block began, or the first date a test failed.
3. The URLs tested, covering the main site, subdomains and article pages, with the result for each.
4. Server logs showing that no request reached the site at the time of the refusal, which points to a block on OpenAI’s side and not to your own security rules.

OpenAI’s public blocklist wording and earlier controversies

OpenAI’s help page says ChatGPT agent may not visit certain websites for security, safety and compliance reasons. It describes a blocklist that applies across the virtual browser and apps, according to the OpenAI Help Center.

The report says OpenAI’s public help pages describe the blocklist and state that browsing is blocked on sites linked to illegal activity.

Where the accounts differ

Search Engine Journal says OpenAI’s help pages blame browsing failures on website security rules, and its author says their own experience contradicts that. The current OpenAI help page only mentions a blocklist and does not specify causes.

That same help page says ChatGPT agent is no longer available. OpenAI points users to ChatGPT Work for longer multi-step tasks and to cloud browser for supported browser workflows.

Earlier debate over blocking

Site owners have discussed blocking OpenAI’s bots before. In 2023, users on Hacker News discussed blocking GPTBot, and commenters noted that robots.txt is not enough. Some sites use Cloudflare-style bot protection as well.

Atlas, agent browsing and prompt injection risks

ChatGPT Atlas is an AI browser that OpenAI introduced in October 2025. It integrates ChatGPT into web browsing and has a native macOS client, according to CyberInsider.

Agent Mode is a feature that lets ChatGPT click, navigate and act within a browser on the user’s behalf. In Atlas it can click, move between tabs and act on pages. OpenAI said it pauses before sensitive actions such as visiting financial sites.

Security researchers have warned that AI browsers are vulnerable to prompt injection, where hidden instructions in web content are treated as commands, as reported by The National CIO Review. This is a separate risk from the Aura check. Site-level checks like Aura are one layer of safety, and the facts do not link Aura to prompt injection.

Open questions and what happens next

The report says the publisher’s case was still under internal review by OpenAI specialist teams. No outcome was reported.

Several questions remain unanswered:

• Why the publisher’s site was flagged.
• Whether the block was intentional, which OpenAI’s specialist teams were still reviewing.
• Whether prompt history plays any role, which the report calls unconfirmed.
• Whether OpenAI will create a public appeal route, given that none exists now.

The facts also say nothing about an Aura app, an Aura login or an Android version, which people often search for. The Aura in this report is a site-safety check inside OpenAI’s systems.

Sources

• Search Engine Journal
• OpenAI Developers
• OpenAI Help Center
• The National CIO Review
• news.ycombinator.com
• wald.ai
• CyberInsider

Photo: Search Engine Journal