ChatGPT can now log into websites on your behalf and stay logged in — and that changes everything about what agentic AI means in practice. In this episode, I break down exactly how ChatGPT Work’s new cloud browser works, how to set it up safely, and why permissions and human oversight are non-negotiable.
What Actually Launched on 25 August
On 25 August, OpenAI switched on a feature called cloud browser inside ChatGPT Work. The release note says it can “help you get tasks done on some websites that require you to sign in.” We’re talking things like setting up a utility account, booking an appointment, or pulling data from an insurance portal.
This is also the end of the Atlas story. OpenAI announced on 9 July it was retiring Atlas, its standalone browser, and folding browser-based agentic work into ChatGPT itself. Atlas was switched off on 9 August — 16 days later, signed-in browsing arrived.
How It Actually Works (In Plain English)
Cloud browser is not your browser. It runs on OpenAI’s servers, with its own cookies, its own sessions, its own history. It cannot see your saved passwords, your extensions, or your existing logins on your laptop.
When it hits a login page, it stops and shows you a secure form. You type your credentials yourself. OpenAI says those credentials go directly to the remote browser, the model cannot see them, they are not stored, and they are not used for training. There’s also a review model that checks for phishing before that form appears.
Here’s the part that matters most: once you’re logged in, the session stays open until it expires — and that session lives on OpenAI’s infrastructure, not your machine. The browser keeps working even after you close your laptop lid.
How to Set It Up Safely
- Check you have access. Cloud browser is available on paid ChatGPT plans in supported regions — not Free or Go. If you’re on a managed workspace, your administrator controls whether it’s on.
- Set your permissions first. Go to Settings, then Cloud browser. Choose Always ask — not auto approve, and definitely not always allow. OpenAI itself flags always allow as the riskier option.
- Start small and start boring. Pull last month’s numbers from an analytics dashboard. Check a supplier portal for open invoices. Do not point this at your banking, payroll system, or any citizen-facing government login — not yet.
Where It Falls Down
John Voorhees at MacStories tested it and got mixed results. On iPhone it logged into a simple site and pulled the data. On Mac it failed completely — the browser froze, the login panel didn’t appear, and CAPTCHAs pushed him into manual takeover. His verdict: the idea is better than the implementation.
OpenAI is honest about the risk too. Its own documentation says safeguards against prompt injection, phishing, and unintended actions “do not eliminate every risk.” It’s designed to ask you before anything hard to reverse — like confirming a booking or making a payment. Designed to. Not guaranteed to.
The Bit You Cannot Ignore
OpenAI protects your password well. What it holds is the session — and a live session is the thing that actually opens the account. So keep it on always ask, clear your sessions when the job is done (Settings > Cloud browser > Browser data), and if the account holds other people’s personal data, do not go near it until your organisation has written down who is accountable when it clicks the wrong thing.
If you want to build your AI literacy and skills, I can help
📚 Grab AI Playbook on Amazon, the perfect podcast companion.
📰 Subscribe to Human in the Loop, my LinkedIn Newsletter
🎓 Take the CPD Accredited AI Playbook Diploma
📞 Book a call at digitaltraining.ie
Sources
OpenAI, ChatGPT Release Notes: 25 August 2026 entry on cloud browser launch. https://help.openai.com/en/articles/6825453-chatgpt-release-notes
OpenAI, Using cloud browser in ChatGPT: Official documentation on how cloud browser works and permissions. https://help.openai.com/en/articles/20001280-using-cloud-browser-in-chatgpt
OpenAI, Evolving Atlas into ChatGPT: Explains the retirement of Atlas and transition to ChatGPT browser-based agentic work. https://help.openai.com/en/articles/20001371-evolving-atlas-into-chatgpt-for-browser-based-agentic-work
MacStories, Hands-On with ChatGPT Work’s New Cloud Browser Feature: John Voorhees reviews real-world performance across iPhone and Mac. https://www.macstories.net/stories/hands-on-with-chatgpt-works-new-cloud-browser-feature/
Key Statistics
– Cloud browser launched inside ChatGPT Work on 25 August 2026.
– OpenAI announced the retirement of Atlas on 9 July 2026; it was switched off on 9 August 2026.
– Atlas was retired 16 days before the signed-in browsing capability arrived in ChatGPT.
– Cloud browser is available on paid ChatGPT plans only — Free and Go tiers are excluded.
– Three permission settings are available: Always ask, Auto approve, and Always allow — OpenAI flags Always allow as the riskier option.
About the Podcast Host
AI and Communications Specialist | Author | Podcaster | International Speaker
Joanne Sweeney is a recognised leader in digital marketing and digital transformation, specialising in the practical application of AI to enhance communication strategies. The founder of Digital Training Institute, Joanne, empowers leaders and communications professionals to leverage AI responsibly and effectively, ensuring transparency, trust, and tangible results.
She completed the Harvard Kennedy School Executive Programme in AI and Public Policy this summer before launching her fourth book AI Playbook, in September. Joanne has also published two editions of Public Sector Marketing Pro, which were preceded by her first title, Social Media Under Investigation Law Enforcement and the Social Web.
Her books have become go-to resources for governments, public sector and policing agencies, as well as marketing and communications professionals, all navigating the challenges of the changing Internet.
Joanne is the host of the AI SIX Podcast, a daily six-minute podcast that provides actionable insights, expert interviews, and practical advice to help professionals navigate the new world of work.
