ChatGPT can log into your web accounts without you now - but should you let it?

ZDNET reports a new ChatGPT Work option that can auto-sign users into websites by storing login cookies in the app’s built-in browser, eliminating the need for repeated credential entry after first login. Testing showed intermittent blocking by Amazon and eBay until cookies were accepted, and security experts flag the bigger risk as delegated identity/authorization session security (e.g., hijacking session cookies/tokens). OpenAI says it cannot view passwords, but experts advise using lower-stakes sites first and routinely reviewing/deleting saved cookies.

Analysis

The economic impact is not on consumer platforms first; it is on the control plane around them. If agentic browsers normalize persistent authenticated sessions, the monetization beneficiary is identity, privileged access, and session-monitoring vendors that can sell policy, revocation, anomaly detection, and delegated-access controls into enterprises adopting these workflows. That argues for a relative advantage to names like OKTA, CYBR, and PANW over pure workflow-enablement software, because the pain point shifts from password management to authorization governance and auditability.

For AMZN and eBay, the near-term revenue effect is negligible, but there is a second-order trust effect: any security incident tied to agentic sessions raises friction around higher-value transactions and could slow adoption of autonomous checkout or account-management features. The more durable risk is that enterprises delay integrating agents into finance, HR, and procurement until vendors prove revocation, logging, and least-privilege controls. Over 1-3 months, this likely shows up as more security-budget urgency rather than any direct hit to commerce KPIs; over 6-18 months, it supports a broader spend cycle in IAM/PAM and browser security.

Consensus may be overestimating the consumer privacy angle and underestimating the enterprise policy angle. This is less about passwords being stolen today and more about session persistence becoming the new credential surface that security teams must govern. The thesis breaks if OpenAI or peers quickly add enterprise-grade controls, fine-grained permissioning, and auditable revocation that remove the need for third-party mitigation.

Key Decisions for Investors

• Buy CYBR or OKTA on a 1-3 month pullback; use the article as a catalyst to own delegated-access and identity governance spend. Risk/reward is favorable if enterprise buyers treat agentic sessions as a new control layer, not a consumer feature.
• Pair trade: long PANW / short AMZN for 1-3 months. The upside in PANW is incremental security-budget pull-through; the short in AMZN is only a hedge against any near-term trust-related noise, not a fundamental deterioration thesis.
• Avoid paying up for workflow-enablement names on this headline alone; keep ADBE and GOOGL on watch, but require evidence that agentic browsing drives meaningful paid conversion before adding exposure.
• Set an alert on OKTA and CYBR around the next earnings guide: if management cites increased demand for session governance, privileged access, or browser isolation, that would confirm a 6-18 month re-rating path.