ChatGPT Can Now Log Into Your Accounts — The Trust Line AI Just Crossed: Read OpenAI's own words next to a security researcher's, and the two describe different products.
OpenAI's pitch: ChatGPT never sees your password. Morey Haber's reframe: the password was never the point.
That gap is the whole story, and most people are reading the wrong half of it.
Here's the fantasy OpenAI is selling, and it is genuinely seductive. Your laptop is powered off in a drawer somewhere while ChatGPT files expense reports across three different platforms — setting up utilities for a new apartment, booking a DMV appointment, reportedly checking your bloodwork costs through an insurance portal, pulling invoices from your email into accounting software.
You do nothing. The tedious admin dissolves. That's the launch, reportedly rolled out this week to ChatGPT Plus, Pro, and Business users inside ChatGPT Work.
Now sit with two words in that fantasy: as you.
The headline reassurance is that ChatGPT can't see your username or password — credentials pass to a remote cloud browser, hidden from the model, not stored, not used for training. True, and beside the point.
Because the feature doesn't work by knowing your password. It works by holding your session.
Once you log in the first time, ChatGPT's cloud browser keeps a cookie, the same token any browser uses to remember you're signed in. Next time, no prompt. The agent is just in.
That session reportedly persists until it expires or you manually clear it. It lives on OpenAI's cloud infrastructure, independent of your device — which, per cryptobriefing, is why your laptop can be off in a drawer.
This is where Haber, chief security advisor at BeyondTrust, stops the marketing cold.
"This sounds like a privacy risk, but I would characterize it more accurately as an identity, security, and authorization risk," he told ZDNET. Protecting the credential, he notes, does not protect the identity.
Then the line that should reorganize how you think about this: "Once authentication succeeds, the AI agent is operating inside an authenticated session with whatever privileges and entitlements the user possesses. At that point, a threat actor may not need the password since attacking the session itself becomes the actual prize."
Read that twice. The password is a key. The open door is the target.
The password is a key. The open door is the target. Attacking the session itself becomes the actual prize.
OpenAI has, per Haber's framing, essentially created a persistent authenticated session sitting in its cloud, carrying whatever privileges and entitlements the user possesses. Cybercriminals have already proven they can steal session cookies and tokens. This is, per cryptobriefing, a concentrated one.
So the real question was never "can the AI see my login." It's: who is responsible the instant an agent, acting under your identity, does something you can't undo?
And that's the question OpenAI hasn't answered — you can see the seams in its own safeguards.
The company says high-impact actions require explicit user confirmation. A reservation, a payment. Fine.
But OpenAI hasn't disclosed exactly what qualifies as "high-impact." The single boundary that determines when the agent acts alone versus when it stops to ask you — the load-bearing safety promise — is undefined.
You are being asked to trust a threshold nobody will show you.
It gets sharper. OpenAI's own help documentation, reportedly under its deprecated ChatGPT agent pages, walks through a prompt-injection scenario, in its own words.
You ask the agent to find a restaurant by checking your calendar and email. While researching, it hits a malicious comment — content engineered to hijack it — "directing it to retrieve a password reset code from Gmail and send it to a malicious website."
That's not a critic's hypothetical. That's the vendor describing, in its help center, how its own agent can be tricked into handing an attacker the keys to a second account.
OpenAI lists mitigations — a review model that screens for phishing, and, per its deprecated ChatGPT agent documentation, prompt-injection monitoring and a "watch mode", plus confirmations. Then it says the quiet part: these measures "don't eliminate all risks."
That is a company conceding the boundary is unresolved while shipping the feature anyway.
Now layer on the liability vacuum, because this is where it actually bites you.
Picture the agent, operating as you, canceling the wrong ticket, or, hypothetically, submitting a payment against a manipulated invoice. Emailing a reset code to an attacker. Changing an account setting you'd never have touched.
Who owns that mistake?
Not the password — you kept that. Not OpenAI, which was careful to say the model never saw your credentials and asks before "consequential" actions it declines to define. Not quite you, since you weren't there and never approved the specific act.
That's the gap. An autonomous agent acting under your identity, with no clear answer to who is accountable the moment it does something irreversible. OpenAI built the door, held the session, and left the question of responsibility on your side of it.
If the liability line were the only problem, you could argue caution. But there's a second, more basic issue: the floor isn't there yet.
On August 27 — the same week this launched — OpenAI's status page confirmed service interruptions hitting Workspace Agents and ChatGPT Work with elevated error rates, on web and mobile. Restored hours later, but restored is not the point.
The system you're being asked to trust with persistent, ownerless sessions into your insurance portal, your bank-adjacent accounts, your email, reportedly experienced interruptions the week it asked for your keys.
Reliability is the precondition for delegation. You don't hand your identity to infrastructure that flickers.
There's a tell in the tech itself, too. In ZDNET's testing, the feature only worked in the ChatGPT Windows app; Amazon blocked the cloud browser on the web, and after a couple of successful runs, blocked it again — the AI itself reportedly guessing the site was rejecting access because of "recent or repeated activity."
Even the destinations aren't sure they want an ownerless agent logging in as you.
So the honest verdict is: not yet. Not because the convenience isn't real — it is — but because OpenAI has shipped autonomy ahead of accountability, and left the most important line, who's liable when the agent acts, undrawn.
For the reckless who'll enable it anyway, minimize the blast radius.
Never use it on anything financial, medical, or identity-critical — no banking, no insurance portals holding your records, no primary email. Email is the master key; a reset code is one prompt-injection away from an attacker's inbox.
Enable only the apps a single task needs, and turn them off after. Avoid vague prompts like "check my email and handle everything" — OpenAI itself flags those as the dangerous ones.
Clear the cookies the moment a session is done: Settings, Cloud Browser, Cookies, delete. A persistent session is a standing target; don't let it stand.
And watch it work. If the safeguards you're relying on can be trained on prompt-injection but not guaranteed against it — OpenAI's words, not mine — then you are the last confirmation step.
The pitch is that you don't have to be there. That's precisely why you should be.