TL;DR
- OpenAI paused two weeks of training on upcoming models over cyber risk, citing its own models breaking into Hugging Face during a July test and early signs that a model called Astra may hit “Critical” on its cybersecurity scale.
- A week later it shipped Cloud browser for ChatGPT Work, a browser running on a remote machine that signs into accounts, fills forms, keeps sessions alive for future tasks, and continues after you close your computer.
- Two live OpenAI help pages give opposite answers about the same product: the user guide explains how to sign in to a website, while the page for website operators says Cloud browser cannot sign in at launch.
- The advice is to test on an account that does not matter, avoid email, banks, utilities, government portals and accounting systems, and there is not enough detail yet to claim OpenAI is mishandling sessions.
In plain English
A browser agent is a web browser that an AI system drives on your behalf. With OpenAI’s Cloud browser, that browser runs on a separate computer in the cloud rather than on your laptop. You type your password into a secure form the model cannot read, the credentials pass to the remote browser, and the browser then holds a signed-in session that persists until it expires. OpenAI offers three permission settings: “Always ask” checks with you before every new site, “Auto approve” lets ChatGPT judge the address and stop if something looks wrong, and “Always allow” opens every website and carries OpenAI’s own label, “This is not recommended.”
The documentation conflict has a practical edge because of allowlisting. Website operators decide which automated traffic to let through services like Akamai, Cloudflare, HUMAN and Vercel, and they make that decision from vendor documentation. The operator-facing page, 27 days old when checked, still said the agent cannot sign in or complete payments, while the user-facing page, 20 hours old, described signing in with two-factor authentication and a persistent session. A security team configuring a firewall from the older statement would be allowing traffic it has misunderstood.
Two things happened at OpenAI in the same week, and they don’t sit together comfortably.
On August 18, OpenAI said it had paused two weeks of training on the newest models it plans to release. Its biggest planned training run is still on hold. The company gave two reasons: its own models breaking into Hugging Face during an internal test in July, and early signs that an upcoming model called Astra may reach the “Critical” level on OpenAI’s cybersecurity risk scale.
The company is now applying its strictest safeguards to Astra and other cyber-related work. It says the extra monitoring alone costs roughly 20% of the inference compute it monitors. OpenAI’s announcement is here.
Earlier in the summer, when OpenAI previewed GPT‑5.6 Sol, it started with a small group of trusted partners. Their participation was shared with the US government at the government’s request. OpenAI said Sol had not crossed its Cyber Critical threshold, but it still came with additional monitoring and restrictions on cyber use. That announcement is here.
A week after the training pause, OpenAI shipped a feature that logs into your accounts for you.
It is called Cloud browser. ChatGPT Work gets its own browser running on a separate computer in the cloud. OpenAI says it can read web pages, click buttons, enter information into forms, and carry out steps on supported public and signed-in websites.
You enter your username and password in a secure form that the model cannot see. OpenAI says the credentials go directly to the remote browser and are not stored by ChatGPT. After that, the browser can carry on with the task. The signed-in session can persist for future tasks until it expires. You do not have to sign in each time.
The product page says it can keep working after you leave the conversation or close your computer. It pauses when it needs input, a sign-in, or confirmation.
Here are three jobs OpenAI suggests, word for word: “Sign in to your utility account and compare plans.” “Find a DMV appointment and prepare a booking for your approval.” “Reconcile invoices and update records in your accounting software.”
Anthropic’s equivalent, on the developer side rather than in the chat app, also moved out of testing around the same time. Claude’s computer-use tool now ships without its experimental label. Anthropic’s documentation is here.
So OpenAI paused research because a model was getting too capable at breaking into things, then released a product that signs into a utility account and can update accounting records from a cloud-hosted browser.
There are different risks involved, but they are close enough that the contrast deserves more attention than it is getting.
OpenAI is dealing directly with the first one. If a model becomes more capable at cyber work than the lab can safely contain, monitor, and evaluate, pausing is the sensible move. It is OpenAI’s research environment, its models and its responsibility.
The second risk is more distributed. It depends on what ordinary users choose to hand over to a browser agent, what websites decide to permit, and how clearly the companies involved explain the limits.
Most people are still learning what it means to give an AI system an instruction rather than a question. “Compare my utility plan” sounds harmless. It can mean access to an account that contains your name, address, billing history, payment details, energy usage, perhaps family information, and the ability to change the plan you are on. “Reconcile invoices” has a similarly large gap between the friendly wording and the system behind it.
OpenAI does include controls. Its settings offer three permission levels: “Always ask,” “Auto approve,” and “Always allow.”
The first checks with you before every new site.
The second allows ChatGPT to assess the address and stop when something looks wrong.
The third permits access to every website.
OpenAI labels that option: “This is not recommended.”
That sentence is doing a lot of work.
Two pages, opposite answers
While checking the documentation, I found a more immediate problem.
OpenAI has two live help pages about the same Cloud browser product, and they give opposite answers about whether it can log into websites.
The user-facing page, updated 20 hours before I checked it, has a section called “Sign in to a website.” It tells users to enter their username and password in a secure sign-in form, complete two-factor authentication where required, and then let ChatGPT resume using the signed-in session. It says the authentication can persist for future tasks until it expires.
The other page is for website operators. It explains how to allow Cloud browser traffic through Akamai, Cloudflare, HUMAN, Vercel, CDNs and firewalls. Under its HUMAN AgenticTrust section, it says: “at launch, Cloud browser cannot sign in to websites or complete payments.”
That page was updated 27 days before I checked it.
The document aimed at users says Cloud browser can work on supported signed-in websites. The document aimed at security teams says it cannot sign in at all. The first is 20 hours old. The second is 27 days old.
It gets worse. The older allowlisting page links to the newer user guide in its Related Articles block. The link description says: “Let ChatGPT handle supported web tasks, including on websites where you sign in.” The contradiction is visible from the page that contains the stale statement.
OpenAI’s own ChatGPT release notes back up the newer user documentation. They say ChatGPT Work’s browser can help on some websites that require sign-in, that a session may remain signed in for future tasks, and that the browser supports password managers.
I checked those pages in Chrome at 19:15 CEST on August 26. Their update stamps, wording and URLs are captured in the accompanying record. OpenAI can alter either page without notice. That is exactly why I would not rely on an old product-security statement when deciding what traffic to allow through a firewall.
What I would do with it
I would not turn this on blindly.
I would start with an account that does not matter much, on a job that has no payment attached to it and no irreversible outcome. Let it collect public options, find an appointment, compare information or draft a process for review.
I would leave email, utilities, banks, government portals and accounting systems alone for now. OpenAI itself puts a utility account, a DMV booking and invoice reconciliation on its suggested-task list. That does not make them safe defaults.
The risk is not only somebody stealing a password. OpenAI says the model cannot see credentials entered into its secure form, which is a sensible boundary. But a signed-in remote browser session still exists somewhere other than your machine. It can retain authentication until it expires. It can take actions after you close your computer. It can operate across systems that contain information an ordinary browser session could never reach without you sitting there.
I have not seen enough detail to claim that OpenAI is mishandling those sessions or the surrounding data. I do want answers before I use one for anything important: what data is retained, what is logged, how remote sessions are isolated, how session state is protected, how quickly it is deleted, and what happens if somebody manages to take control of a task I started.
The pause on Astra says OpenAI understands that more capable systems need more care before they are put to work. Its Cloud browser shows the same problem arriving from another direction: capability is being handed to users before the documentation around it has even caught up.