On August 26, 2026, OpenAI updated ChatGPT Work's cloud browser to handle the step that blocks most useful web automation: signing in to websites. The agent can now pause, hand you a secure credential form, and continue on the authenticated site after you complete login and two-factor authentication.
The headline needs one important correction. OpenAI says the model cannot see or store credentials entered through the secure form, but the remote browser does retain cookies and signed-in sessions until they expire or you clear them. That is what makes repeat tasks useful — and what makes session management the part users need to understand.
This is an incremental but practical extension of ChatGPT Work, not a new model. It turns Work from a public-web research agent into a browser agent that can reconcile invoices, check utility plans, track account-bound information, and prepare bookings on supported sites.
TL;DR — what changed and what did not
| Question | Direct answer |
|---|---|
| Can it use signed-in sites? | Yes, on supported sites through ChatGPT Work's remote cloud browser |
| Who enters the password? | You, in a secure sign-in form; never in the chat |
| Can the model see the password? | OpenAI says no |
| Does OpenAI store the credential? | OpenAI says it does not store the username or password entered there |
| Does the login persist? | Yes, potentially — cookies and the authenticated session can remain for later tasks |
| Can it make a payment without asking? | It is designed to request confirmation before consequential financial, legal, or account actions |
| Will every site work? | No — sites can block automated agents, and some steps remain unsupported |
| Who gets it? | Paid ChatGPT plans in supported regions, excluding Free and Go; rollout and admin policy can vary |
How ChatGPT Work's secure website sign-in works
OpenAI's cloud browser guide describes a delegated browser running on a separate remote computer. You start a task from ChatGPT Work on web or mobile; ChatGPT decides whether to use a connected app, a plugin, the cloud browser, or a combination.
When the browser reaches a supported login page, the sequence is:
- ChatGPT pauses the task and asks you to sign in.
- An additional review model checks the request and destination for signs of phishing or deception.
- You inspect the website address, sign-in preview, and live page.
- You enter credentials and any two-factor code in the secure form.
- Those values go directly to the remote browser rather than through the model conversation.
- ChatGPT resumes the task using the resulting authenticated session.
That boundary matters. It is closer to taking over a remote browser at the login screen than giving an LLM a password in its prompt.
Credentials and sessions are different secrets
OpenAI's wording is precise: the username and password entered in the secure form are not visible to the model and are not stored as credentials. After authentication, however, the cloud browser keeps its own cookies and signed-in state.
| Secret | What OpenAI says happens |
|---|---|
| Username and password entered in secure form | Sent directly to the remote browser; hidden from the model; not stored as credentials |
| Two-factor code | Entered during the secure flow, not pasted into chat |
| Session cookie after successful login | Kept in the cloud browser and may work on later tasks |
| Cookies from your personal browser | Not imported |
| Existing tabs, history, passwords, and extensions | Not shared with cloud browser |
This distinction is the central takeaway: password isolation reduces credential exposure; it does not make an authenticated browser session disposable.
You can revoke that retained access from Settings → Cloud browser → Browser data. OpenAI lets you clear one site's data or all cloud-browser data. Clearing a site's data signs the remote browser out of that account.
What can you ask it to do on a signed-in site?
OpenAI lists account-bound examples including comparing utility plans, tracking a package using connected email plus a carrier site, reconciling invoices in accounting software, and preparing a DMV booking for approval.
The strongest tasks share three properties: they are multi-step, browser-shaped, and still have a clear review point.
Try prompts like these:
Sign in to my utility account when prompted. Compare my current plan with every
fixed-price option available to this account. Build a table of monthly fee,
unit rate, contract term, and cancellation fee. Do not change the plan.
Use the invoices in my connected email and the signed-in accounting site to
reconcile August payments. Flag mismatches and duplicates. Do not edit, submit,
or delete any record until I approve the proposed changes.
Find the earliest DMV appointment within 30 km on a weekday morning. Prepare
the booking, show me the location and cancellation policy, and stop before the
final confirmation.
The explicit stopping rule is not ceremonial. It gives the agent a smaller action budget and makes the intended confirmation boundary unambiguous.
Cloud browser vs desktop browser vs your Chrome session
OpenAI now documents three distinct browsing contexts. Treating them as interchangeable is how users accidentally grant more access than a task needs.
| Browser surface | Where it runs | Session source | Best fit |
|---|---|---|---|
| ChatGPT Work cloud browser | Remote OpenAI computer | Separate cloud-browser cookies | Background tasks that can continue after you leave |
| ChatGPT desktop built-in browser | Inside the macOS or Windows app | Its own app browser state | Visible, attended browsing with tabs, downloads, and annotations |
| Codex Chrome extension | Your normal Chrome profile | Existing tabs, cookies, sign-ins, and extensions | Tasks that genuinely require your current Chrome session |
The desktop built-in browser guide says the local surface can be opened from Work or Codex with Command+Shift+B on macOS or Ctrl+Shift+B on Windows. Unlike cloud browser, it is designed for you to follow and annotate the page as the agent works.
This mirrors the choice Anthropic now exposes between its Cowork built-in browser and Claude in Chrome: use an isolated browser when separation is valuable; use your real profile only when existing authenticated state is necessary.
What people are asking about ChatGPT cloud browser sign-in
Is this the same as “Sign in with ChatGPT”?
No. Sign in with ChatGPT is an identity-provider flow: a partner site uses your ChatGPT identity to create or access an account, similar to “Continue with Google.” Cloud-browser sign-in is the opposite direction: you authenticate the remote browser to an existing third-party website so ChatGPT can complete a task there.
Can ChatGPT keep working after I close my laptop?
Yes. OpenAI says the cloud browser can continue on its remote computer after you close the browser, computer, or phone. It pauses when it needs information, a login, or confirmation. That background execution is the main difference from attended computer use inside Codex.
What stops it from visiting a phishing site?
OpenAI says an additional review model checks sign-in requests and destinations for phishing or deception, and the interface shows the address and a preview before you enter credentials. Users can also choose Always ask, Auto approve, or Always allow for website access, plus per-site rules.
Keep the default conservative. OpenAI itself labels Always allow as not recommended. Site permission also does not remove confirmation for consequential actions.
What if the website blocks ChatGPT?
The task may fail even when the same page works in your regular browser. Sites can restrict automated agents, login flows can be unsupported, and some transactions still require takeover or manual completion.
For website operators, OpenAI's allowlisting documentation says cloud-browser requests use Web Bot Auth and HTTP Message Signatures under RFC 9421. Signed requests let supported edge providers distinguish ChatGPT's agent traffic from an anonymous bot, but the site still decides whether to admit it.
The security boundary is better, not complete
Secure credential entry solves one narrow problem: the model does not need the password as text. It does not solve the broader browser-agent problem.
Once authenticated, the agent can read account data and interact with whatever the session exposes. A malicious page can still attempt indirect prompt injection, and a mistaken instruction can still target the wrong account, record, or transaction. OpenAI says its safeguards test for prompt injection, phishing, and unintended actions but do not eliminate every risk.
Use the cloud browser with these defaults:
- Keep website access on Always ask for sensitive workflows.
- Check the hostname and sign-in preview before typing anything.
- Enter secrets only through the secure form, never in the conversation.
- Give the agent read-only goals before edit or submit goals.
- Require a stop before payments, bookings, messages, deletions, or policy changes.
- Clear a site's browser data when repeat access is no longer useful.
- Prefer a purpose-specific connected app or plugin when it exposes narrower permissions.
The AgentForger incident is a useful reminder that agent authorization is a system property, not a single safe input box. Credential isolation, site permissions, constrained tools, and human confirmation have to work together.
What this changes for ChatGPT Work
ChatGPT Work already had the ability to research, coordinate longer tasks, and create finished materials. Signed-in cloud browsing closes the gap between “find public information” and “finish a workflow inside my account.”
That is a meaningful product step, but not blanket permission to hand every SaaS session to an agent. Start with low-consequence accounts, keep site approval explicit, and build repeatable workflows around reviewed proposals, not autonomous commitments. The useful mental model is a remote junior operator with a temporary browser session — capable of doing the clicks, but still requiring a clear scope and a human at the irreversible step.
Related on explainx.ai
- ChatGPT Work vs Codex: what actually changes
- OpenAI Codex computer use on Windows and mobile
- Claude Cowork's built-in browser
- Claude in Chrome browser extension and safety guide
- What is indirect prompt injection?
- ChatGPT AgentForger workspace-agent security incident
- ChatGPT Work thread orchestration
- Login with ChatGPT and Codex OAuth explained
Official references: Using cloud browser in ChatGPT · Using the built-in desktop browser · Cloud browser allowlisting
Details are accurate as of August 27, 2026. Cloud-browser availability, supported sites, plan access, and confirmation behavior can change during rollout; check OpenAI's current help documentation before using it for sensitive workflows.