OpenAI's ChatGPT Work Agent Can Now Access Password-Protected Sites

OpenAI's ChatGPT Work agent can now operate on websites that require a login. The agent doesn't handle authentication itself. You sign in manually, then hand control back.

How the handoff works

When the agent hits a page requiring authentication, it pauses and prompts you to take over the virtual browser via ... → Take over browser. You log in yourself. During that window, the agent captures no screenshots, so passwords and sensitive inputs stay private. Once you return control, the agent resumes from its prior workflow state, though in some cases it may need to restart the run or prompt you again if the handoff can't complete cleanly.

Cookies persist across sessions, so you authenticate once and subsequent runs on that site pick up without repeating the login. To clear saved sessions, sign out of the relevant sites and remove cookies in your ChatGPT data control settings.

What the virtual browser actually does

This takeover flow lives in the agent mode virtual browser, a separate system from ChatGPT Work's cloud browser feature. The cloud browser works only on public pages and cannot accept credentials, use autofill or password managers, sign in to websites, or complete payments. The virtual browser is a more capable environment that supports the manual takeover flow.

The agent will never type your password, store credentials, or invoke a password manager. Inputs you enter during takeover mode are not collected or seen by the model.

What this opens up

Before this change, the agent was limited to the public web, which excluded dashboards, SaaS tools, internal portals, and anything behind a paywall. The takeover model gives the agent access to authenticated sessions without exposing credentials. Practical workflows this enables:

• Pulling data from SaaS dashboards like Salesforce, HubSpot, or Jira and compiling reports
• Monitoring subscription-only sites and summarizing updates on a schedule
• Navigating internal tools that require SSO or a company login
• Automating workflows across apps without a direct plugin integration

Beta users have already used it to review thousands of sales leads, check product launch readiness across Jira and go-to-market plans, and compare airline passenger experiences.

Where this fits in OpenAI's agent stack

ChatGPT Work combines the web interaction capabilities of Operator, the synthesis depth of deep research, and ChatGPT's conversational intelligence. The login takeover is a direct carry-over from Operator's design: keep humans in the loop for sensitive actions, let the agent handle everything else.

OpenAI launched ChatGPT Work as a cloud agent with write access to email, Slack, calendars, and code repositories, while retiring its year-old Atlas browser. The takeover login flow is one of the lessons from Atlas made concrete in the new architecture.

Availability and usage limits

Agent mode is available on Pro, Plus, Business, Enterprise, and Edu plans in all supported countries. Usage limits by plan:

• Plus: 40 agent messages per month
• Pro: 400 agent messages per month
• Business and Enterprise: 40 messages per month, or 30 credits per message on flexible pricing

Authentication steps mid-task, including the takeover login, do not count against your message limit. Enterprise admins can control the agent's access to browser use, plugins, and connected tools, preauthorize sensitive actions, and set usage limits.

The security model is straightforward: you keep control of credentials, the agent keeps control of the task. One login with persistent cookies is a concrete step toward agents that can operate across the authenticated web, not just the public one.