ChatGPT Work now signs into web accounts automatically, raising security concerns

The new capability is available only to ChatGPT Pro and Plus subscribers. It works through ChatGPT's built-in browser, which stores login cookies just like an ordinary browser. The first time the AI needs to access a website, it prompts the user to enter a username and password or passcode. On later visits, it relies on the saved cookies to sign in without any user input.

OpenAI suggests tasks such as figuring out utilities for a new apartment and signing up for the right plan, booking a DMV appointment, filling out passport renewal forms, or checking X-ray and bloodwork costs through an insurance portal. In a hands-on test, ZDNet asked ChatGPT Work running in the Windows app to log in to an Amazon account and list items on a public wish list. The first attempt required manual sign-in, but subsequent attempts were automatic.

The test also surfaced hiccups. Amazon blocked the ChatGPT cloud browser when ZDNet tried the feature through the ChatGPT website, and only the Windows app worked. After a few successful runs, Amazon later blocked access again, with ChatGPT suggesting the site may have rejected repeated activity. In another test, ZDNet asked ChatGPT Work to log in to an eBay account and then deleted the stored cookies; on the next attempt, the AI required the username and password again. Users can remove cookies by going to Settings, selecting Cloud Browser, and managing saved cookie data.

OpenAI says ChatGPT cannot see or train on usernames and passwords, and that users control which sites ChatGPT Work can access. The AI also asks for confirmation before consequential actions such as completing a reservation or payment. Despite those assurances, security experts warn that the feature carries real risk. Morey Haber, chief security advisor at identity security provider BeyondTrust, told ZDNet that this is more accurately an identity, security, and authorization risk than a privacy risk. He explained that once authentication succeeds, the AI operates inside an authenticated session with the user's privileges, and attackers may target the session itself rather than steal the password. He also pointed to attack vectors like prompt injection and the proven ability of cybercriminals to steal session cookies and tokens, which could put login details at risk.