OpenAI updated the ChatGPTwork proxy browsing capability. The system can continue to perform on behalf of the user after a certification has been completed on the website that requires login, and the relevant login status may be retained for subsequent operations. This feature is on line at the end of the web page and on the mobile side.

You can go on duty once you log in.

According to the updated note issued by OpenAI on 25 August, when a user delivers a mission to ChatGPT Work, if the target website needs to log in, the system will eject a login page and the user will enter its own account number, password or security authentication code. Upon certification, the agent can continue to operate on the site and the user need not remain in front of the page.

OpenAI indicates that this process supports the password manager. According to the company, the model itself could not see the user name and password, and the information would not be stored or used for training.

Sessions may be kept for subsequent tasks

This feature is facilitated by the fact that users do not have to enter passwords over and over again to allow assistants to continue to submit forms, to collect bills or to perform other on-site operations. At the same time, however, the status of login may be retained and the agent may then continue to visit the same account.

  • Support platform: web and mobile ChatGPT Work Browser
  • Login mode: user manually enters a certificate or authentication code
  • Clear by: delete session by station

The dispute is focused on the duration of the mandate.

The article mentions that this means that the system does not just get one-time access, but is a sustainable session entry. More than the password itself, attention is drawn to account access capabilities for post-entry sessions.

In its note, OpenAI emphasized that users could leave the task with the agent and proceed with the system. But it also raises a more direct question: When the user is not present, the agent can continue to operate in the log-in account.

In the original version, the existing protective measures, which mainly covered the password entry chain, did not really eliminate the risk of authorization arising from the persistence of a log-in session. In other words, while the system does not see the password, as long as the session remains valid, it still has access to the accounts in close proximity to the user.

Currently, users are able to manually clear browse logs and sessions at each site, but this control is still dependent on ex post management rather than a one-time step-by-step authorization.