OpenAI has introduced secure website sign-in for ChatGPT Work, allowing its AI agent to access password-protected services without exposing user credentials to the underlying model. The feature is rolling out today on web and mobile for Plus, Pro, and Business subscribers, and enables the system to navigate authenticated sessions through a cloud-based remote browser while keeping usernames and passwords entirely invisible to ChatGPT. For subscribers, the update targets browser-based tasks that users would previously have had to open a browser and click through themselves.

How the Authentication Works

The authentication flow uses a secure form that transmits credentials directly to the remote browser instance, bypassing the AI entirely. A separate review mechanism inspects login requests for phishing indicators before sign-in pages are presented to users, who can inspect website addresses and preview forms before proceeding.

Access permissions are configurable across three tiers—always ask, auto-approve, or always allow—with the system defaulting to explicit user approval for each new domain. Once a session is authenticated, it persists via cookies across subsequent tasks until it is manually cleared or expires. This removes friction from recurring workflows while maintaining strict separation between the user's local browser data and the cloud environment where the agent operates.

The rollout was announced on X by OpenAI's ChatGPT account:

Basically: if it's something you'd normally have to open a browser and click through yourself, try asking ChatGPT Work to do it. Logging into websites is rolling out today on web and mobile for Plus, Pro, and Business users. pic.twitter.com/PlPhrCIGes

— ChatGPT (@ChatGPT), August 25, 2026

From Conversational Assistant to Autonomous Agent

The capability significantly broadens ChatGPT Work's operational scope, elevating it from a conversational interface to an autonomous agent capable of executing complex, multi-step tasks across authenticated digital environments. The step extends a lineage OpenAI began with Operator, its January 2025 research-preview agent for browsing and clicking through websites on a user's behalf.

Powered by OpenAI's GPT-5.6 model family, the platform can now independently manage end-to-end workflows—ranging from scheduling government appointments and processing insurance reimbursements to analyzing advertising campaigns and managing vendor portals—delivering finished outputs including documents, spreadsheets, and slide decks rather than simple text responses.

The expansion positions OpenAI at the forefront of the commercial AI agent race, in which seamless interaction with authenticated SaaS platforms and internal enterprise systems has emerged as a critical competitive battleground. Rivals are converging on the same frontier: Anthropic's Claude has offered computer-use capabilities since October 2024, and Google and Microsoft have both shipped agents that act inside the browser. By architecting the system so that credentials never enter the model's context window while still enabling persistent authenticated sessions, OpenAI seeks to reconcile deep automation with enterprise security requirements. That separation speaks to a risk security researchers have long flagged for browser agents: anything entering a model's context, including passwords, can potentially be extracted through prompt-injection attacks, in which malicious web content attempts to hijack an agent's instructions.

The rollout underscores accelerating industry momentum toward agentic systems capable of independently managing business processes, though widespread organizational adoption will likely hinge on whether these technical safeguards adequately address evolving regulatory frameworks and compliance standards governing automated access to sensitive accounts. Concrete open questions include how CAPTCHAs and other anti-bot defenses will treat automated browsers, how services whose terms of use restrict automated access respond, and how the design maps onto regimes such as the EU AI Act, whose obligations phase in through 2026, alongside GDPR rules on automated processing of account data.

Source: Metaverse Post