ChatGPT Work Can Now Auto-Login to Websites Using Stored Session Cookies

OpenAI has added a new capability to ChatGPT Work, its agentic assistant, that allows it to log into your website accounts automatically after the first sign-in, without prompting you for credentials again. The feature launched Tuesday and is available only to ChatGPT Pro and Plus subscribers.

How it works

The first time ChatGPT Work needs to access a password-protected site, it prompts you to enter your username and password, either manually or via a third-party password manager's autofill. ChatGPT's built-in cloud browser then stores the resulting session cookies. On subsequent tasks involving the same site, the agent uses those stored cookies to sign in without asking you again.

OpenAI suggests use cases including signing up for apartment utilities, booking DMV appointments, filling out passport renewal forms, checking insurance costs, and searching job candidate profiles.

In hands-on testing by ZDNET, the feature worked reliably through the ChatGPT Windows app but failed on the ChatGPT website, where Amazon blocked login attempts from the ChatGPT cloud browser. Repeated attempts through the Windows app were also blocked after a few successful logins, which ChatGPT attributed to Amazon flagging the activity pattern.

Users can review and delete stored cookies through Settings > Cloud Browser > Browser data > Cookies. Deleting a site's cookies forces ChatGPT to request credentials again on the next login attempt.

OpenAI's privacy claims

According to OpenAI, ChatGPT's underlying model never sees or trains on your username or password, and the AI always asks for confirmation before taking consequential actions like completing a payment or reservation. Users control which sites the agent is permitted to access.

Security concerns

Security professionals contacted by ZDNET say the bigger issue isn't credential exposure but what happens after authentication succeeds. "This sounds like a privacy risk, but I would characterize it more accurately as an identity, security, and authorization risk," said Morey Haber, chief security advisor at BeyondTrust. Once an AI agent operates inside an authenticated session, he noted, it holds whatever privileges and entitlements the user has — meaning an attacker targeting the session itself, rather than the password, could gain the same access.

Haber pointed to prompt injection as a known attack vector where a malicious actor hijacks an AI session to extract data or trigger unwanted actions. Session cookie and token theft is an established cybercriminal technique independent of AI, and storing persistent authenticated sessions in a browser—AI-controlled or not—inherits that same exposure.

Shane Barney, CISO at Keeper Security, recommended starting with low-stakes, routine sites and avoiding financial or healthcare accounts until OpenAI provides more detail on how persistent access is protected and how users can review or revoke it. He also advised checking account settings regularly for unrecognized active sessions, since task completion doesn't necessarily end the underlying access.

What this means

This is a convenience feature with a real tradeoff: it removes repeated login friction for agentic tasks but extends the attack surface of any given web account to include the AI agent's session state, not just the user's credentials. OpenAI's claim that the model never sees raw credentials addresses one narrow risk—credential theft from the AI itself—but does not address session hijacking, prompt injection, or the possibility that a compromised or manipulated agent could act with a user's full account privileges. Until OpenAI publishes clearer detail on session lifecycle management and revocation, the responsible approach is limiting this feature to low-value accounts and auditing connected sessions regularly, as both security experts recommend.