ChatGPT Work Lets AI Sign Into Your Accounts and Operate Alone

OpenAI has shipped a feature that lets ChatGPT log into user accounts and complete tasks autonomously, without requiring the user to be present. The capability, called ChatGPT Work, is framed as a productivity tool for agentic workflows. It is also, depending on your threat model, one of the more consequential expansions of AI system permissions in recent memory.

The core mechanic is straightforward: a user authorizes ChatGPT Work to access an account, the model handles authentication, and then continues operating across multiple sessions without re-authentication. OpenAI states that the model never sees the user's password during this process. That claim is technically accurate and also somewhat beside the point.

The real exposure is not the password. It is the session token.

Session tokens are the credentials a web application issues after a successful login. They are what allow you to stay signed into Gmail without typing your password every five minutes. When ChatGPT Work authenticates on a user's behalf, it acquires a session token, and that token can persist across tasks. Any attacker who can access that token, through a compromised ChatGPT instance, a man-in-the-middle intercept, or a vulnerability in how tokens are stored, gains authenticated access to the account without ever needing the underlying password. This is not a theoretical attack class. Session token hijacking has been a documented threat since the early 2000s, and it remains one of the most reliable vectors in modern credential-theft campaigns.

"OpenAI says the model never sees your password, but a signed-in session can persist across tasks, and you can step away while it works."

The "step away while it works" framing is where the risk compounds. Traditional account security assumes a human is present and capable of noticing anomalous behavior. When an AI agent operates autonomously across sessions, that assumption collapses. If ChatGPT Work is compromised mid-task, or if it executes an action the user did not intend, there is no human in the loop to interrupt it. The attack surface is not just the token itself but the entire window of autonomous operation.

For enterprise and regulated-industry users, the compliance dimension adds another layer of complexity. In financial services, healthcare, and other sectors governed by strict access-control requirements, account actions typically must be logged, attributed to a specific human actor, and auditable on demand. An AI agent operating autonomously across sessions does not map cleanly onto those frameworks. Whether a ChatGPT Work session constitutes "user action" for audit purposes is a question most compliance teams have not had to answer before, and the answer matters for SOC 2, HIPAA, and PCI-DSS adherence alike.

OpenAI is not alone in pushing toward agentic capabilities. Anthropic, Google, and a range of smaller AI developers have all been building toward models that can take real-world actions on behalf of users, browsing the web, writing and executing code, managing files, and interacting with external services. The security questions ChatGPT Work raises are not unique to OpenAI; they are the structural challenge of the agentic AI category. What distinguishes this release is the explicit persistence of authenticated sessions across tasks, which is a meaningful step beyond single-session tool use.

The productivity case is real. Autonomous workflows that can handle multi-step tasks across platforms without constant user input represent a genuine reduction in friction for knowledge workers. The question is not whether the feature has value but whether the current implementation gives users adequate visibility into what is being accessed, for how long, and with what scope. Token expiration windows, granular permission controls, and real-time activity logs are the minimum viable security infrastructure for a feature of this kind. Whether OpenAI has shipped those controls alongside the capability itself is not yet clear from the company's public documentation.

What is clear is that the security community will be scrutinizing ChatGPT Work closely. Persistent session tokens held by AI systems represent a new and largely unmapped attack surface, one that sits at the intersection of two fields, AI safety and web application security, that have historically operated independently. The convergence is now unavoidable.