What Is the ChatGPT Browser and How Does It Work?

The ChatGPT browser is a real web browser that ChatGPT drives on your behalf. It opens pages, clicks buttons, fills in forms and reads what comes back, and it can do it all inside the same chat window you were already using.

As of the August 2026 update it runs in OpenAI's cloud rather than on your machine, and it can sign into websites without ever seeing your password, and those sessions stay active between chats.

So why is this such an important feature? Well, most of the systems a business actually runs on sit behind a login, and until now that was the wall that stopped an AI agent being any help with them.

In this article, I'll talk you through what the ChatGPT browser is, how each piece works, what it still cannot do, and when you should use something else instead.

What the ChatGPT browser is, and what it is not

Two different things get called "the ChatGPT browser", and OpenAI gives them separate names.

The built-in browser shipped inside the ChatGPT desktop app in July 2026, for use with ChatGPT Work and Codex. It ran on your computer, which meant your laptop had to stay open for the length of any job.

The cloud browser is the August 2026 update, and it is the one this article is about. Same idea, different location. It runs on OpenAI's own machines, so you can reach it from the web version and from mobile, not just the desktop app.

Neither is ChatGPT Atlas, which was a standalone browser you installed and drove yourself. OpenAI sunset Atlas in August 2026.

How the ChatGPT browser works, step by step

The sequence is the same every time.

You give ChatGPT a task that needs a website. It recognises that it needs the browser and asks your permission to visit that specific domain before it opens anything. You approve, a browser session starts in the cloud, and from there it navigates, clicks and reads pages the way a person would. You can even open the browser panel beside the chat and watch it happen live.

In the walkthrough in the video above, you can see a perfect example of the ChatGPT browser in action. I asked it to open go9x.com as though it were a prospective customer, find the booking page, and report the earliest available slot for an AI training call. It opened the site and clicked through to the booking button, then stopped and asked for separate permission to access cal.com, the calendar tool behind that button. Once approved, it loaded the calendar and read off the first free date.

Two things are worth noticing here—the permission request came before any page loaded, and a second one came when the journey crossed onto a different domain. Permission is granted per site, not per task.

"These sort of things I could kick off this task, close my laptop and check back on it on mobile, and that is the beauty of it running in the cloud."

Because the session runs on its own machine, it also has its own filesystem. When ChatGPT downloads a file during a task, that file comes back to you directly in the chat rather than sitting in a downloads folder you cannot reach.

How ChatGPT signs into websites without seeing your password

This is the update that matters most.

When the browser lands on a login page, it doesn't try to type credentials itself. It hands you a sign-in dialogue inside the chat. You type your username and password into that dialogue, and the values pass straight to the browser session. Credentials entered this way go to the cloud browser and are not visible to the model, and your password is not stored.

The practical version in the video above is a monthly admin job: log into a mobile phone provider's account and download last month's invoice. The browser found the login page, prompted for credentials through the secure dialogue, signed in, then located the invoices section and downloaded July's invoice on its own. The provider's site was in German, which made no difference to it.

That distinction between "gets you signed in" and "sees your password" is the whole security model. You are granting the browser an authenticated session, not handing an AI model your credentials.

Be clear about what that does and does not protect. Your password is not sitting in a chat log. It does not follow that the session is harmless once established, because anything you can do on that site while logged in, the browser can now also do. Research presented at Black Hat in August 2026 found every AI browser tested was vulnerable to indirect prompt injection, with data exfiltration and account takeover as the outcomes, and no complete fix available.

Why your logins stay active between chats

Your sign-ins persist. What does that mean? Well, to extend the example above: In a fresh chat, which is a different session entirely, I can ask the browser to open the same phone account and fetch the March invoice instead. It goes straight there without asking me to log in again.

That works the way it works in any browser. The session is held in a cookie, and as long as that cookie has not expired, every subsequent visit is a logged-in visit.

If you don't want this to happen, you can see and clear those cookies yourself. Under Settings and then Cloud browser, you get access to your browser data, including the stored session for every site you've signed into. Removing the cookie for a site logs the browser back out of it.

For a monthly task like downloading an invoice, this is the difference between a job you can schedule and a job that needs you present to type a password every time.

How to control which sites ChatGPT can visit

Approving every request by hand gets old quickly, so there are three levers in Settings.

1. Per-site permissions: Add a specific site and set it to always allow or always block. A site set to "always allow" is visited without a prompt. A site set to "always block" is never visited at all.

2. The default permission: This governs everything you have not named. The safe setting is "always ask", which is what it ships as.

3. Auto approve mode: This is the middle way. ChatGPT applies automated risk checks to each site and decides whether it looks risky enough to warrant asking you.

My own configuration is conservative:

"What I really like is this setup of having it always ask, but then we can add specific sites here that we basically whitelist for it to access whenever it wants."

Keep the default at "always ask", then whitelist the handful of sites you have deliberately decided to automate. You get the convenience where you want it without handing over blanket approval.

What the ChatGPT browser cannot do yet

There are three notable limitations to the ChatGPT browser.

1. It is on paid plans only. The sign-in feature needs a paid ChatGPT plan in a supported region. Free and Go are excluded. Confirm your own tier before building a process on it, because coverage of exactly which paid tiers qualify has not been consistent.

2. Some sign-in methods are not supported. Email and password works. In the video, I flag´ the social sign-on options, log in with Google, with Facebook, with Apple, as an untested gap rather than a documented one. OpenAI's own wording is hedged in the same direction, noting only that a sign-in step may not be supported. If the tool you want to automate offers social sign-on alone, test it first.

3. Some websites block it outright. This is the one that will catch you. Asked to fetch invoices from an Amazon business account, the browser was refused.

"Unfortunately it said that Amazon actually rejected this browser as an unsupported client, and this is definitely a known issue from the team at OpenAI."

OpenAI's own documentation acknowledges this, stating that some sites use security measures restricting access from automated browser agents, and that a site may block ChatGPT even when it works normally in your own browser. The sites most likely to do it are large retailers and banks with aggressive bot detection. Again, make sure you test the specific site before you depend on it.

When to use a connector instead

Before you point the browser at a tool, check whether that tool already has a connector. A connector "talks" to the service directly through its API. While the browser has to load the page, find the right buttons and click them like a person, connectors are faster, more reliable, and don't break when the site changes its layout.

Gmail is a clear example of this. There is a Gmail connector, so asking ChatGPT to open a browser and log into Gmail is the wrong move even though it would probably work.

In summary

The ChatGPT browser is ChatGPT driving a real browser for you, now running in the cloud rather than on your laptop. It signs into sites through a dialogue that keeps your password away from the model, and it holds those sessions open between chats so a repeat job does not need a repeat login. You control access per site, and the sensible default is to keep it asking and whitelist only what you have thought about.

It needs a paid plan, it does not handle every sign-in method, and some sites will refuse it. Check for a connector before you reach for it, because a connector will nearly always do the job better.

The tasks worth handing over first are the small recurring ones you already do by hand: pulling a monthly invoice, checking a supplier portal, updating a record in a tool nobody has connected yet. Pick one, watch it run once, and you will know quickly whether it is worth automating properly.