The cloud browser can retain sessions, for 2FA and seek approval before bookings, payments and other consequential actions.
By Ryan Merket · Published
Primary source: OpenAI on X
Why it matters #
Website authentication turns ChatGPT Work from a public-web assistant into an agent that can operate inside personal accounts, widening its usefulness and the cost of a mistaken action.
OpenAI added authenticated website access to ChatGPT Work on Tuesday, letting its cloud-based agent continue tasks behind login screens after a user enters credentials through a separate secure form.
The capability is rolling out on web and mobile for Plus, Pro and Business users, according to OpenAI. It expands the range of jobs Work can attempt beyond public web research and form filling, covering tasks such as setting up utilities, checking reimbursements and finding government appointments.
Authentication has been a practical boundary for browser agents. An agent can compare public information without knowing who the user is. Booking an appointment, opening an account dashboard or updating a reimbursement claim usually requires access to a private session. OpenAI's update gives ChatGPT Work a route across that boundary while separating the user's credentials from the model operating the browser.
The password goes to the browser, not the model
When ChatGPT Work reaches a supported login page, it s the task and presents the user with a secure sign-in form. The user enters a username and password there and completes any two-factor authentication step. OpenAI says those credentials pass directly to the remote browser, remain hidden from the model and are not stored by ChatGPT.
The agent can then resume its work inside the authenticated session. According to OpenAI's updated cloud browser documentation, the session can persist for later tasks until it expires or the user clears that site's browser data.
That distinction matters because the cloud browser runs on a remote computer controlled through ChatGPT Work. It maintains its own cookies, site permissions and logged-in sessions rather than borrowing credentials, tabs or browsing history from the user's phone or computer. A user must sign in separately even when the same account is already open in a local browser.
Before showing the credential form, OpenAI says an additional review model checks the requested login and destination for signs of phishing or deception. Users can inspect the website address, preview the form and open the live page before entering their information. OpenAI still tells users to check each address and never paste passwords, security codes or payment details into the chat itself.
OpenAI is pushing Work from research into execution
OpenAI introduced ChatGPT Work on July 9th as an agent for longer jobs spanning websites, connected apps, local files and finished deliverables. Work can operate through a remote cloud browser on web and mobile, while the desktop version can also interact with local applications and files when given permission.
The login feature makes Work substantially more useful for consumer and administrative tasks. OpenAI's examples include finding a DMV appointment, signing in to compare utility plans, saving apartment listings and reconciling invoices inside accounting software. The original X announcement also points to passport appointments and reimbursement checks.
Those examples reveal the product direction. OpenAI is positioning Work to execute the tedious sequence around a task, rather than ending with instructions for the user to carry out. A utility setup request may involve researching providers, opening the correct account page, authenticating the customer, entering address information and reviewing plan terms. Website login allows the agent to continue that sequence inside the user's account.
OpenAI has retained approval checkpoints for steps with financial, legal or account consequences. ChatGPT Work is designed to ask before confirming a booking, making a payment or taking another action that may be difficult to reverse. Users can also take control of the remote browser when the agent gets stuck or when they want to complete a step themselves.
The cloud browser will not work everywhere. Websites can block automated traffic, authentication methods may be unsupported and some transactions may still require the user to take over. The rollout also depends on account eligibility, region and workspace permissions. OpenAI's Work documentation says access is still expanding across eligible accounts.
OpenAI's credential isolation addresses the most obvious objection to handing an AI agent a password. It does not remove the wider risk of giving software an authenticated session with permission to click, type and submit information. The safeguards now move to the actions taken after login: which site the agent entered, which account it used, what data it changed and whether the user understood the final confirmation.