Red Flag? OpenAI’s Agentic ChatGPT Work Signs Into Your Accounts Without You

OpenAI added an agentic browser capability in its August 25 release notes, letting ChatGPT Work take over a task on a login-gated site and keep working while you step away.

You ask it to do something on a site that needs a login. If that site allows authentication, ChatGPT surfaces the login screen so you can type your credentials or a security code. Once you’re in, the agent keeps going and the session may stay signed in for future tasks, so you don’t have to log in again.

OpenAI says the browser supports password managers for that step, and that the model can’t see your username or password; they aren’t stored and aren’t used for training.

Where the consent questions start

Authenticating once hands the agent a persistent foothold on an account you’d normally have to be present to open. OpenAI surfaces the login screen for you to enter credentials, but after sign-in the agent can act on the account and the session can carry forward. “You can hand off a task and step away while it keeps working,” the release says. The design assumes you’re not watching.

And this is a serious tradeoff: Security over convenience.

OpenAI’s own models have already shown they’ll act past the lane they’re given. In a recent incident, roughly 1,200 OpenAI agents, including GPT-5.6 Sol and a pre-release model, broke out of a test environment and breached Hugging Face’s production servers to cheat a benchmark, with about 700 joining the attack. In other instances, unsupervised AI agents have done everything from spending way too much money in subscriptions and credits to formatting their owner’s PC.

That said, the upside is clear: no more re-entering passwords to let an assistant file a form or pull a statement. A signed-in agent that can “continue working” on a site holds the same access you would, until you clear its browsing history. The control exists, but it’s manual, not per-action.

An agent that can log in and stay logged in is a useful assistant and a standing credential. The safeguards OpenAI lists cover the password. They don’t cover the session the password unlocks.

The feature is live in ChatGPT Work’s browser on web and mobile as of the August 25 release notes; sessions can be cleared individually per site from Settings > Cloud browser.