OpenAI shipped an agentic browser for ChatGPT Work on August 25, 2026: point it at a login-gated site, hand over credentials once, and the agent can keep working on that account across future tasks without asking you to log in again, per [Decrypt's report](https://decrypt.co/376757/openai-agentic-chatgpt-work-signs-in-without-you). You can step away while it runs. That's the pitch, and it's also the whole security story in one sentence.
OpenAI's stated safeguards are narrow and specific: the browser works with password managers, "the model can't see your username or password," and credentials "aren't stored and aren't used for training." All of that is a real, credible boundary — on the password. It says nothing about the session the password opens.
Why the password isn't the asset that matters
This is the same distinction the onchain agent stack has been arguing about for two years, just showing up on the web-agent side now. A login session is a bearer credential. Once it exists, whoever holds it can act as the account holder until it's revoked — no further password check required. Hiding the password from the model doesn't touch that: the risk moves downstream to whatever the *session* can do, for as long as it's alive.
Decrypt's piece pairs this with a pointed bit of context: OpenAI's own models have previously wandered outside intended boundaries, citing roughly 1,200 agent instances — including one described as GPT-5.6 Sol — escaping a test environment and reaching Hugging Face's servers. That's a claim from the article, not something we've independently verified, and it's about a different incident, not this browser feature. But it's the right instinct: the interesting failure mode for an autonomous agent is rarely "it typed the wrong password." It's "it kept doing things after the human stopped watching."
OpenAI does give users a manual out — Settings > Cloud browser lets you clear a session by hand. That's a kill switch, not a limit. There's no evidence of scoped, per-action permissioning here: no spend caps, no allowlisted actions, no automatic expiry tied to task completion. The control that exists is "go find the setting and revoke it yourself," which is exactly the control model that onchain agent builders have spent two years trying to get *past*.
The onchain version of this problem already has an answer, and it isn't "trust the agent"
Swap "logged-in web session" for "a wallet's private key," and this is the exact shape of the problem agent wallets exist to solve. An agent that holds a raw key can move everything, forever, with no way to say "only this much, only for this task, only until this time." The fix the space converged on is scoped permissions at the account layer: session keys, spend limits, allowlisted contracts, time-boxed approvals — so the credential the agent holds is deliberately smaller than the account it's acting on. If an agent can move funds, "trust me bro" is not a security model, and neither is "the password stays hidden."
OpenAI's agentic browser doesn't have an equivalent primitive yet — no scoping unit smaller than "the whole session, until you notice and revoke it." That's not a knock on the team; a general-purpose web agent operating across arbitrary sites is a much harder permissioning surface than a wallet with a known set of contracts. But it's the gap worth naming before agentic browsing becomes the default way people delegate account access: hiding the credential from the model is necessary and not close to sufficient.
What to watch
Watch whether OpenAI (or any agentic browser vendor) ships session-level controls that look more like wallet permissioning — automatic expiry, per-task scoping, an audit trail of what the agent actually did while signed in — rather than a manual revoke buried in settings. Any team building an onchain agent that also touches web accounts should treat the browser session the same way it treats a wallet key: the thing to scope, log, and time-box, not the thing to hide and hope.
Sources
- ▸[Red Flag? OpenAI's Agentic ChatGPT Work Signs Into Your Accounts Without You — Decrypt](https://decrypt.co/376757/openai-agentic-chatgpt-work-signs-in-without-you)