AI Agent for a Website That Requires Login: Do It Safely

To let an AI agent work on a website that requires a login, it has to be signed in somehow. There are three ways to do that: give a cloud service your password or cookies, sign in yourself inside a cloud browser the agent then uses, or let the agent run a copy of the Chrome profile you are already signed into. Each one keeps your session somewhere different, and that decides who holds it. Whichever you pick, read-only work comes first. The agent should pause before it submits anything. Your bank should never be part of it.

This guide is for people who want an export out of a vendor portal, not for developers wiring up Playwright. It compares the three setups, explains what August 2026's prompt-injection research means for you, and covers what to do when a site asks for a code or blocks the bot.

Why does an AI agent keep landing on a login page?#

Because it is using a browser that has never met you. Most agents start a fresh browser for each task, often a "headless" one with no window. A fresh browser has no cookies. When a site checks whether you are signed in, it finds nothing and sends you to the login form.

Your own browser keeps a session cookie after you log in, which is what keeps you signed in for weeks. Everything below is about giving the agent a session like that without also giving it your password.

Three ways to let an AI agent into a website that requires login#

1. Hand a service your credentials or cookies#

This is how most no-code scrapers work. Browse AI, for example, offers two options for a robot that has to log in: "Login with my session cookies" or "Login with my password". Its help centre calls session cookies "recommended for most cases". The robot then runs on Browse AI's servers with your session. The same help centre warns that an account "could be temporarily flagged", that logins reached "from changing IP addresses" can trip a site's security, and, for sensitive platforms like LinkedIn, suggests considering "local automation solutions instead of cloud-based extraction."

Developer frameworks work the same way in code. Browser Use can export cookies and local storage from a signed-in browser into a file and load that file into a headless browser. Browser Use Cloud also offers persistent cloud profiles.

2. Sign in yourself inside a cloud browser#

This is the ChatGPT model. As of September 2026, ChatGPT Work runs a cloud browser on "a separate computer in the cloud." Since August 25, 2026, it can work on signed-in sites. When it reaches a login page, it pauses and shows a secure sign-in form. OpenAI says credentials entered there "go directly to the remote browser," are "not visible to the model," and are not stored. A separate review model checks the page for phishing before the form appears.

The session is what stays: "The authentication will persist for future tasks until it expires." The cloud browser keeps its own cookies. It does not use your personal browser's sessions or saved passwords, and you can clear a site's data under Settings > Cloud browser > Browser data. OpenAI's release notes list sign-in for Plus and Pro, and its help page says availability depends on your plan, region and workspace permissions. (For more on what ChatGPT Work replaced, see ChatGPT Agent Mode Is Gone.)

A close variant is an assistant built into the browser you use every day, such as Claude in Chrome, Gemini in Chrome, Perplexity Comet or ChatGPT's Chrome extension. These act inside your live, signed-in session. That is convenient, and it means the agent can reach every account you're logged into.

3. Run a copy of your own Chrome profile on your computer#

The agent runs its own Chrome on a copy of one of your Chrome profiles, so it starts out signed in to whatever that profile was signed in to. The cookies stay on your computer. No password goes into a chat or a form the agent controls, and nothing is uploaded to a scraping service.

Which approach is safest? A comparison#

The honest summary: none of these makes the agent itself trustworthy. They differ in where a stolen session would be stolen from, and in how many of your accounts one bad instruction could reach.

Does prompt injection matter if I'm the one who signed in?#

Yes, more than anything else in this guide. Prompt injection is when text on a page, in an email or in a calendar invite gives the agent instructions, and the agent follows them as if you had given them.

At Black Hat USA in August 2026, two groups showed how bad this is for signed-in agents. Brave security engineer Artem Chaikin said every AI browser he analysed was vulnerable to prompt injection. Zenity Labs demonstrated zero-click exploit chains against Claude in Chrome, Gemini in Chrome, Perplexity Comet, ChatGPT Atlas (which OpenAI shut down on August 9) and Copilot Edge. In one chain, a request to summarise an email led to exfiltrated Gmail data and a shared Google Drive. Zenity says that chain worked even in Claude's "ask before acting" mode. Chaikin's conclusion was that there is no known perfect fix, only layers of defence.

OpenAI says the same about its own product: its safeguards "do not eliminate every risk." A local profile copy doesn't solve this either. The agent is still reading pages someone else wrote. What you control is how much a hijacked agent could reach, which is why the rules below matter more than the choice of tool.

Why won't Chrome let tools attach to your real profile?#

Since Chrome 136, Chrome ignores the remote-debugging switches that automation tools use when they point at its default profile folder. Those switches only work on a separate data directory. Google's reason: attackers had been "using Chrome Remote Debugging to extract cookies."

So "just drive my normal Chrome" isn't an option for tools that control Chrome remotely anymore. The options are a browser extension inside your live Chrome, which is the in-browser assistant model above, or a copy of your profile in its own folder. Copying works on a Mac because the copied cookies are encrypted with a key in your login Keychain, which the same Chrome can read. It is also why a copy doesn't work if you move it to a different Mac.

How does this work in Universe, step by step?#

Universe is a Mac app that uses the third model. It copies a Chrome profile (cookies, saved logins, local storage) into its own folder and runs its own Chrome on that copy. It doesn't attach to the Chrome you have open. The agent runs on your own model account: Claude, ChatGPT, Gemini or Grok.

1. Decide which profile to copy. Your main profile is signed in to everything, and after the Black Hat research that is a reason not to use it. In Chrome itself, make a profile just for this work and sign it in to only the portal or tool the job needs. It is the biggest safety step you control.

2. Copy it and read its card. Each profile card in Universe lists the sites the copy is signed in to. Universe works this out from cookie names and never reads cookie values to do it. Site icons come from Chrome's local favicon cache, so no request goes out to draw them. If the card lists your bank, you copied the wrong profile.

3. Give the agent a task with limits. Name the site, the data and the output. For example: "In the vendor portal, go to Invoices, filter to August, download the CSV, and put a summary sheet in this folder. Don't change any settings or submit any forms." What comes back is a file in the session's folder.

4. Watch or review. Every browser step is recorded with a screenshot and can be replayed as a filmstrip, so you can see exactly what the agent clicked, including after the fact. Universe says that sending, paying and posting wait for you. Write the rule into the task anyway.

5. Pause instead of closing. Pausing keeps the logins between turns, so the next task starts signed in. When a session expires, use Copy again to refresh the copy from Chrome, or Sign in by hand to open the copy in a visible window and log in yourself.

A few facts that matter for trust:

• Profiles never leave the Mac. They aren't synced to Universe's cloud and can't move to another Mac, because the cookie key is in that Mac's Keychain.
• Deleting a profile moves it to the Trash, so a slip of the mouse isn't permanent.
• What does leave: the pages the agent reads go to your model provider as part of the task, like any agent. If you're signed in to Universe, session transcripts and the files a session makes sync to Universe's cloud, so sharing and other Macs work. The cookie jar doesn't.

The browser works on every plan, including Free. See pricing for the caps, or download Universe to try it.

What rules should you set before an agent touches a signed-in site?#

• Read-only first. Start with tasks that only look and download. Give the agent write access to a site only after you've watched it do a read-only run cleanly.
• Pause before submitting. Tell the agent to stop and ask before any submit, save, send, delete or "confirm" button. Write "stop and show me" into the task.
• Keep money and identity out of it. Leave out banking, brokerage, payroll, tax portals and your primary email. If a profile is signed in to any of those, don't copy it.
• One job, one profile. A profile signed in to one site limits what a hijacked agent can reach.
• Don't paste secrets into the chat. OpenAI's docs say it plainly: "Never paste passwords, security codes, or payment details into the conversation."
• Go at a human pace. Hundreds of page loads a minute is how accounts get flagged.
• Read the terms. Some sites forbid automated access outright (see the FAQ).

What does this look like on real work?#

Commercial listings. A broker wants every new listing matching a saved search, in a table with asking price, size and days on market. Check the site's terms first. LoopNet's terms forbid "any robot, spider or other automatic device or manual process" used to monitor or copy the site without written permission. For a site like that, use the export or data product it sells. The agent is still useful afterwards: turning that export and your notes into the sheet your underwriting model reads. See Universe for real estate and investment banking.

A vendor portal export. Many supplier and utility portals hold your invoices behind a login and have no API. A monthly task is a good fit: sign in, filter to last month, download the statements, and match them against your records. Bookkeepers can pair it with reconciling a bank statement against invoices, or see Universe for bookkeeping.

A CRM with no export button. Some tools only let you export on a higher plan, or cap exports. An agent can open each record you can already see, copy the fields you name into a sheet, and stop. Keep it read-only. Check your plan's terms and your company's data policy before you pull customer records out of any system.

Why does it break, and how do you fix it?#

• A 2FA prompt. A copied session may look like a browser the site already trusts, so it may not ask again. When it does, don't give the agent your authenticator secret. In Universe, use Sign in by hand and type the code yourself. In ChatGPT Work, the sign-in form asks for the code.
• Bot checks and blocks. Some sites detect automated browsers and refuse them. OpenAI's docs say a site "may block ChatGPT from accessing the site or completing your task, even if the same website works normally in your own browser." Nothing reliably fixes this, and trying to get around a site's defences is a terms problem. Do that step by hand or use the site's own export.
• An expired session. Sessions end on the site's schedule, not yours. The agent will land on the login page again. Sign in again in Chrome and use Copy again, or use Sign in by hand. With a cookie-based scraper, you hand it fresh cookies.
• It ran on the wrong Mac. In Universe, a profile copy exists only on the Mac that made it. A turn moved to another Mac doesn't have Universe's browser tools. Keep browser jobs on the Mac that holds the profile. (More on second Macs in Run AI agents overnight on a spare Mac.)

Where does Universe fit, and when is something else better?#

Universe fits when you want the session to stay on your computer and the work to come back as files in a folder you own. It also fits when you want to see which sites a profile is signed in to before handing it over.

Pick something else when:

• The job must run while every computer you own is off. A cloud browser like ChatGPT Work, or a hosted scraper like Browse AI, is the right shape for that. Universe schedules need a Mac that is on.
• You aren't on a Mac. Universe is Mac only, on Apple silicon or Intel with macOS 13 or later.
• You're a developer building this into a product. Browser Use and similar frameworks give you code-level control over sessions, storage state and 2FA.
• The site has an official export or API. Use it. It is faster and it is allowed.

For a wider map of the kinds of agents on a Mac, see Desktop AI agents for Mac, explained.