OpenAI enables ChatGPT Work to access password-protected web accounts

OpenAI has launched a new capability for ChatGPT Work that allows the AI to sign into a user's web accounts autonomously. The feature, available to ChatGPT Pro and Plus users, marks a significant shift toward agentic AI by enabling the system to execute tasks behind password-protected walls.

The system operates via a built-in cloud browser that stores session cookies after an initial manual login by the user. Once these cookies are saved, the agent can access the authenticated sites for future tasks without requiring further user interaction. OpenAI states that the AI model does not see usernames or passwords, and that these credentials are not used for model training. Users maintain control over their data and can manage or delete stored cookies through the Settings > Cloud Browser > Browser data > Cookies menu.

The Push for Agentic AI

This update is part of a broader strategic move by OpenAI to transition large language models from text generators into autonomous agents capable of multi-step workflows. By overcoming the "login wall," ChatGPT Work can now perform real-world actions on behalf of the user, such as managing e-commerce wish lists, checking insurance portals, or booking appointments. This capability transforms the AI from a consultant into an operator that can interact directly with the web services users rely on daily.

Delegated Identity Risks

Despite the productivity gains, the feature introduces what security experts call "delegated identity security risk." While OpenAI may protect the initial password, the resulting authenticated session remains a potential target. Morey Haber, chief security advisor at BeyondTrust, warns that protecting credentials does not necessarily protect an identity from hijacking. According to Haber, once authentication is successful, the AI agent operates within a session possessing the full privileges and entitlements of the user.

Security professionals are particularly concerned about vulnerabilities such as prompt injection, which could theoretically allow an attacker to hijack an active session to steal sensitive data or perform unauthorized actions. Because the agent acts with the user's full authority, any compromise of the agent's instructions could lead to a compromise of the account itself.

Guidance for Users

As the feature rolls out, experts advise a cautious approach to adoption. Shane Barney, CISO at Keeper Security, suggests that users should begin by using the feature on lower-stakes sites for routine tasks. Barney recommends holding off on integrating the agent with accounts tied to highly sensitive information, such as healthcare records or financial services, until the security implications are better understood.