ChatGPT Work gains autonomous account login capability raising security concerns
OpenAI launched a feature in ChatGPT Work on 25 August 2026 that allows the AI agent to autonomously log into and remain authenticated in user web accounts using stored session cookies. Security researchers raised concerns that persistent authentication sessions in a remote cloud environment could pose risks if the system is compromised or misused.
What happened
On 25 August 2026, OpenAI extended ChatGPT Work's cloud browser to handle login-protected websites. When an agent encounters a login page, users enter their username and password through a secure form, and the browser then maintains an authenticated session using cookies for future tasks without requiring re-entry of credentials.
According to OpenAI's documentation, the cloud browser runs on a remote machine independently and continues operating even after the user closes their device. The session cookies persist in this remote browser, allowing the agent to access authenticated accounts while the user's device is offline.
Reported impact
Security researchers raised concerns that the persistent session cookies stored in the cloud browser could potentially allow unauthorized access to user accounts. A cookie containing authentication information is sufficient to access an account without the original password or two-factor code if the remote browser is compromised.
Index analysis
The feature relies on users to restrict which sites the cloud browser can access through settings with three options: 'Always ask', 'Auto approve', or 'Always allow'. OpenAI explicitly notes that 'Always allow' is 'not recommended'.
OpenAI stated that credentials entered through the secure form go directly to the remote browser and are not stored, seen by the model, or used for training. However, the authentication session and associated cookies remain active in the cloud browser environment.
Classification
Sources and evidence
This record was researched and written by the Index, based on the following original reporting.