From 25 August, ChatGPT's cloud browser can sign in to password-protected sites. Credentials go through a secure form directly to the remote browser; the model never sees them, they are not stored, they are not used for training, and a separate review model checks for phishing before the form appears. All of that is real and well designed.
The password was never the asset
Once the credentials are entered, a live authenticated session sits on OpenAI's servers and — in OpenAI's own words — "the authentication will persist for future tasks until it expires." A persistent session cookie grants account access without the password and without the second factor. The security boundary has moved from "OpenAI holds no credentials" to "OpenAI holds a bearer token to your account." That is a weaker claim wearing a stronger one's clothes. Sessions can be cleared per-site or globally under Settings.
What the common framing gets wrong
The second reassurance is that the agent asks before consequential actions. It does — on the interactive path. But OpenAI's automations documentation, published openly, states that "scheduled tasks use approval_policy = "never" when your organization policy allows it" and that "scheduled tasks run unattended and use your default sandbox settings." If an administrator forbids it, tasks fall back to the selected permission mode. Otherwise the confirmation prompt protects the path with a human watching, while the event-driven path — the one with nobody watching — runs with approvals off.
To be precise about what OpenAI does and does not say
OpenAI does not state anywhere in a single sentence that a persistent browser session composes with an unattended scheduled task. That combination is our reading of two of its documentation pages, and it should be read as such rather than as a disclosed behaviour. Both halves are quoted above from OpenAI's own material; what has not happened is anyone reading them against each other.
Why the triggers matter
Automations fire on webhooks: new Gmail messages filtered by sender or subject, new Slack messages in selected channels, GitHub pull-request activity. Those are all surfaces an outsider can write to. A prompt injection placed in an inbound email or a pull-request title now reaches a task that runs on a schedule, inside a logged-in browser session, with approvals disabled by default.