OAI-SearchBot vs GPTBot vs ChatGPT-User: What Each One Does

OpenAI documents its crawlers on one page, and each has a separate robots.txt token. The split matters because the three bots serve three different products: search results inside ChatGPT, training data for future models, and live page fetches a person asks for in a conversation. A rule for one token says nothing about the other two.

OpenAI also lists a fourth agent, OAI-AdsBot, which only visits landing pages submitted as ChatGPT ads. If you do not advertise in ChatGPT, it should never visit you, so it is left out of the table below.

No. OpenAI states that each setting is independent: a site can allow OAI-SearchBot to stay in search results and disallow GPTBot to keep its content out of training. That is the most common reason companies treat the two differently, and it is a legitimate policy choice, not a mistake.

What does remove you from ChatGPT search answers is blocking OAI-SearchBot, either by name or by a blanket User-agent: * / Disallow: / group that OAI-SearchBot falls back to because it has no group of its own. That second case is easy to miss. In our robots.txt survey below, one large documentation site named GPTBot and ChatGPT-User with Allow: / but never named OAI-SearchBot, so OAI-SearchBot fell through to the site's catch-all Disallow: / — the opposite of what most sites intend.

OpenAI adds one practical note: if a site allows both OAI-SearchBot and GPTBot, it may use one crawl for both purposes to avoid fetching the same page twice. So seeing only one of the two in your logs does not mean the other is blocked.

OpenAI's own wording is that ChatGPT-User handles actions a person starts, such as asking ChatGPT to open a link, and that "because these actions are initiated by a user, robots.txt rules may not apply." It is not a crawler in the usual sense: it does not wander your site, and OpenAI says it is not used to decide whether content may appear in search.

Practically, that means a robots.txt rule is the wrong tool if your goal is to stop ChatGPT users from opening a specific page. A login wall, authentication or a firewall rule does that. And it means the token to manage for search visibility is OAI-SearchBot, not ChatGPT-User — OpenAI says so directly on the same page.

We have not tested whether ChatGPT-User actually ignores a robots.txt disallow. That would need a live ChatGPT session against a site we control, and our measurement rules allow only official APIs, not the consumer chat app.

On 2026-11-09 we ran Leadee's ChatGPT Bot Access Test — the same engine as the tool at the top of this page — against the 7 Netbase-owned sites that Leadee tracks (all part of Netbase JSC, the company behind Leadee) (the Netbase portfolio case study) plus leadee.ai. The test reads robots.txt for all three OpenAI tokens and fetches the homepage once with the OAI-SearchBot and ChatGPT-User user agents, comparing the result with a normal browser request to catch a firewall that blocks the bot but not people.

All 8 sites allow all three bots, and every one names them explicitly rather than relying on the wildcard group. None blocked the live fetches. That is the expected result for sites whose teams already work on AI visibility, so treat it as a baseline rather than a finding: the interesting failures in the field are the inconsistent policies in the next section.

One limit applies to every test of this kind, ours included: the live probe sends OpenAI's user-agent string from Leadee's own server, not from OpenAI's IP addresses. A firewall that verifies OpenAI's published IP ranges could treat the real bot differently, in either direction. Only the robots.txt verdict is a hard fact. How Leadee measures, and what it does not claim, is on the methodology page.

Mostly not. In Leadee's 2026-10-25 tracker round for the 7 Netbase JSC sites, AI engines cited 59 different domains in their top-10 source lists — directories such as G2 and DesignRush, app stores, vendor sites and forums. On 2026-11-09 we read each domain's robots.txt once (one request per site, no bot user agent) and checked the rule for the homepage path.

Two results stand out. Reddit's robots.txt disallows every unnamed bot, including all three OpenAI tokens, yet reddit.com was cited 25 times across the engines in that round — a reminder that being cited and being crawlable are not the same thing, and that engines can reach content through agreements or other routes a robots.txt file does not show. And help.sap.com allows GPTBot and ChatGPT-User by name while leaving OAI-SearchBot on a catch-all disallow, which is the reverse of the usual "opt out of training, stay in search" policy.

The limit we cannot remove from this data: the citation counts come from three engines combined (Perplexity, Google AI Mode and OpenAI's API with web search), and the per-brand analyses do not split cited domains by engine. So this table shows how often-cited sites treat OpenAI's bots, not which of them ChatGPT itself cited.

Anyone can send a request that calls itself OAI-SearchBot; the user-agent string is just a header. OpenAI publishes the IP ranges for each bot as JSON files (searchbot.json, gptbot.json and chatgpt-user.json on openai.com), and recommends allowing requests from those ranges if you want to appear in search. A request whose user agent says OAI-SearchBot but whose IP is outside the published list is not OpenAI.

This cuts both ways for firewall rules. Blocking by user agent alone stops honest bots and lets impostors that change their header through; allowing by user agent alone lets impostors in. Most CDN bot-management features verify known bots by IP for this reason. If you write your own rule, match on both.

If buyers in your market ask ChatGPT for suppliers, allow OAI-SearchBot. Without it, ChatGPT search cannot show your pages as a source, and every other fix in our step-by-step guide to ranking in ChatGPT starts from that.

GPTBot is a business decision about training data, not a visibility switch. Companies that publish documentation or product facts they want models to learn from tend to allow it; publishers who license content often block it. Neither choice changes whether ChatGPT search can cite you today.

Leave ChatGPT-User alone unless you have a specific reason. It only fetches pages people ask for, and a person who pastes your URL into ChatGPT is usually someone evaluating you. For the exact robots.txt lines, CDN switches and WordPress settings, see AI crawlers and robots.txt; for everything else ChatGPT-specific, start at the ChatGPT SEO overview, and for how an engine turns what it reads into a recommendation, see how AI chooses suppliers.