Secure Sign-In in ChatGPT for iOS: Smart 1Password, 2FA Win

Secure sign-in arrived in the ChatGPT app on 25 August 2026, and it is the first time OpenAI has asked people to type a real username and a real password into a screen the assistant put in front of them. The release note is short. The consequences are not.

On an iPhone, ChatGPT Work’s browser can now stop at a login page, show you a secure sign-in form, let a password manager such as 1Password fill it, wait while you complete a two-factor step, and then carry on with the job you handed over. That is a cybersecurity change dressed up as a convenience feature, and it deserves to be read that way.

This article does three things. It quotes exactly what OpenAI shipped and where the secure sign-in form actually appears on iOS, because the headline version of this news is looser than the documentation. It explains how 1Password and two-factor codes fit into the flow, including the part Apple handles rather than OpenAI.

And it looks hard at the thing nobody puts in a headline: the signed-in session that survives after you close your phone, sitting on OpenAI’s servers, doing exactly what a stolen session cookie does. If your business is weighing up autonomous AI agents with real account access, the secure sign-in design is the detail that decides whether this is safe enough for you.

Table of contents

What Actually Shipped In The ChatGPT Secure Sign-In Update
How The Secure Sign-In Form Works, Step By Step
Where 1Password Fits Into ChatGPT Secure Sign-In
The 2FA Support In Secure Sign-In, Read Carefully
The Session That Outlives Your Secure Sign-In
Secure Sign-In Against The Old Rules Of Credential Hygiene
The Controls Around Secure Sign-In That You Should Actually Set
What A Business Should Do About Secure Sign-In This Week
Secure Sign-In: Frequently Asked Questions
References

The change is small in wording and large in scope, so it is worth separating the release note from the interpretation.

The release note, word for word

OpenAI’s ChatGPT release notes entry for 25 August 2026 is headed “ChatGPT Work can now complete tasks on signed-in websites.” The body reads: “ChatGPT Work’s browser on web and mobile can also help you get tasks done on some websites that require you to sign in — so you can hand off a task and step away while it keeps working.” The secure sign-in mechanism is described plainly: “If a website allows authentication, ChatGPT will surface the login screen so you can securely enter your credentials. You may also need to enter a security code.”

The password manager line

The sentence that generated the 1Password headlines is this one: “ChatGPT Work’s browser supports the use of password managers for simple, safe login.” OpenAI does not name 1Password, Bitwarden, iCloud Keychain or anything else. It supports the category. 1Password is simply the most common third-party manager on iOS, which is why it became the shorthand for the whole secure sign-in story.

Where the secure sign-in form appears on iOS

There is no new toggle in the ChatGPT app for iOS. The secure sign-in form belongs to the cloud browser, and OpenAI’s cloud browser documentation says you “Open ChatGPT on web or mobile and start a task in Work.” So the iPhone is a supported surface for secure sign-in, not the target of a dedicated iOS release. The same documentation adds that if ChatGPT gets stuck it “will ask you to take over the cloud browser on your phone or computer.”

Which plans get it

The release note closes with a hard line: “Authentication in ChatGPT Work’s browser is available for Plus and Pro plans.” The cloud browser itself is broader — “available in ChatGPT Work on paid ChatGPT plans in supported regions, excluding Free and Go” — but the secure sign-in capability inside it is narrower than the browser that hosts it.

What OpenAI did not say

The headline version	What the documentation actually says
ChatGPT for iOS added 1Password support	The cloud browser supports password managers as a category, on web and mobile alike
ChatGPT added 2FA support	The secure sign-in form can accept a second-factor code for the site you are logging into
It is an iOS app feature	It is a ChatGPT Work cloud browser feature reachable from the iOS app
Everyone gets it	Authentication is limited to Plus and Pro, in supported regions
ChatGPT logs in for you	ChatGPT pauses and you complete the secure sign-in yourself

The flow has five moments, and the security properties of the whole feature live in the gaps between them.

The pause

The cloud browser runs on a remote machine, not your iPhone. When it reaches a page it cannot get past, OpenAI’s documentation says it “pauses when it needs your input, sign-in, or confirmation.” Nothing about the secure sign-in step is autonomous. The agent stops and waits for a human.

The phishing review before the form appears

This is the part most coverage skips, and it is the strongest piece of the design. “Before presenting a sign-in request, an additional review model checks the request and where your information will be entered for signs of phishing or deception.” A second model inspects the destination before you are ever shown a box to type into.

Your own inspection

You are not asked to trust that review blindly. OpenAI states that “You can review the website address and a preview of the sign-in form, and inspect the live website before continuing.” On a phone that is a small screen and a real decision, so the secure sign-in step is a moment to slow down rather than tap through.

Entering the credentials

“Credentials entered through the secure form go directly to the remote browser. The username and password entered there are not visible to the model, and ChatGPT does not store those sign-in credentials.” The release note repeats the same commitment: they “are never seen by the model or used in model training.”

The two-factor step

The cloud browser guide is explicit: “If a website requires sign-in, use the secure sign-in form and complete any two-factor authentication steps.” A one-time code, a push approval or a passkey prompt all belong to the destination site, not to OpenAI. The secure sign-in form is a conduit for whatever second factor the site demands.

What happens after

“After you sign in, ChatGPT can resume the task using your signed-in session. The authentication will persist for future tasks until it expires, so you do not need to sign in each time.” Keep that sentence in mind — the rest of this article keeps returning to it.

The 1Password half of the story is mostly Apple’s work, and understanding that changes what you should expect.

What OpenAI actually promises

One sentence, no vendor names: the browser “supports the use of password managers for simple, safe login.” In practice that means the secure sign-in form behaves like a normal credential field, so the operating system’s autofill machinery can offer to fill it. It is a compatibility statement, not an integration announcement.

How iOS Password AutoFill does the filling

On an iPhone, filling is handled by Apple’s Password AutoFill, with 1Password acting as the credential provider behind it. 1Password’s own documentation is precise about the boundary: “Password AutoFill only has access to the metadata that 1Password provides: usernames and domain names, which need to be available for Autofill to suggest credentials in your browser and apps. Only that metadata is saved to an encrypted Password AutoFill keychain, and other apps can’t access it.”

You are always the one who chooses

1Password adds a second constraint that matters for a secure sign-in inside an assistant: “To sign in to an account using Autofill, you must unlock 1Password and choose an item. As always, 1Password will only fill your credentials after you choose to fill them.” Nothing fills silently. Face ID or Touch ID gates every fill, so an agent cannot help itself to a vault item.

Storing one-time passwords in 1Password

If you keep your two-factor codes in the same vault, the secure sign-in flow gets shorter. 1Password lets you attach a one-time password to any login item: open the item, select Edit, then “Select Add More, then select One-Time Password” and scan the QR code. On iOS you can also route verification-code setup through the system: “Open the Settings app on your iPhone or iPad. Select Passwords, then select Password Options. Select 1Password in the Set Up Verification Codes Using section.”

The trade-off nobody enjoys discussing

Storing the password and the second factor in one vault means a single unlocked vault satisfies both factors. 1Password’s guidance is blunt about the adjacent risk: “If you turn on filling suggestions, guard your device passcode closely. Anyone who knows it can find out which websites and apps you have logins for, including your usernames for those logins.” For a business account used through a secure sign-in inside an AI assistant, that is a policy question, not a preference.

Two different second factors are in play here, and conflating them is the easiest mistake to make.

The site’s 2FA versus your OpenAI 2FA

The security code you type into the secure sign-in form protects the airline, the utility or the accounting system you asked ChatGPT to work in. It does nothing for your OpenAI account. Those are separate authentication events, protected by separate settings, and only one of them is covered by the 25 August release note.

What OpenAI supports on your own account

OpenAI’s multi-factor authentication documentation lists four options: an “Authenticator app: Use one-time codes from an app such as Google Authenticator or Authy”, “Push notifications: Approve sign-ins by responding to a prompt sent to your trusted device”, “Text message: Receive a 6-digit code by SMS or WhatsApp”, and “Passkey: Use a passkey as an additional form of MFA for your account.” Once enabled, “it applies across OpenAI services, including ChatGPT and the API Platform.”

The gap that should worry administrators

Buried in the same document is a one-line answer with real weight. Can admins enforce MFA for a workspace or organisation? “Not at this time. MFA cannot currently be enforced at the ChatGPT workspace or API Platform organization level.” A feature that parks live sessions for your company’s systems inside a user’s ChatGPT account cannot be paired with an enforced second factor on that account.

Passkeys and Advanced Account Security

Passkeys are the stronger route. OpenAI describes them as “cryptographic credentials stored on your device or a security key, such as a YubiKey, and are protected by built-in security methods like biometrics (Face ID, Touch ID), a device PIN, or a hardware key touch.” Advanced Account Security, rolled out on 30 April 2026, goes further: it “uses stronger sign-in methods like passkeys or compatible security keys and turns off weaker paths like password sign-in, email/SMS sign-in codes, and email-based account recovery”, and requires “at least two secure sign-in methods, including one that works across devices.”

The recovery warning attached to it

Stricter protection means stricter recovery. OpenAI’s own caution is that “If access to all sign-in methods and recovery keys is lost, access to the account may be lost.” Anyone turning this on for a work account needs the recovery key stored somewhere that survives a lost phone — a 1Password vault is the obvious answer, which closes the loop rather neatly.

Here is the part that changes the risk calculation, and it is stated openly in OpenAI’s documentation rather than hidden.

Persistence is the feature and the risk

“The authentication will persist for future tasks until it expires, so you do not need to sign in each time.” That is genuinely convenient. It also means that after one secure sign-in, an authenticated session for your account exists on infrastructure you do not control, reachable by an agent that acts on instructions it reads from web pages.

Why a stolen session beats a stolen password

A session cookie is a bearer token. Whoever holds it is already inside, without the password and without the second factor. The whole point of the secure sign-in design — the model never sees your credentials — is undermined if the artefact the flow produces is more useful to an attacker than the credentials were. Coverage of the launch made exactly this point, noting that a stolen cookie grants access “without the password and without the second factor.”

What the breach data says about credentials

The 2026 Verizon Data Breach Investigations Report, published on 19 May 2026 using 2025 data, is the reference point most security teams reach for. It recorded the first year in nineteen in which vulnerability exploitation overtook stolen credentials as the leading way in — and credential abuse still turned up almost everywhere else in the chain.

Credential-related findings in the 2026 Verizon DBIR (% of breaches)

Credential abuse anywhere in the breach chain 39%

Vulnerability exploitation as initial access 31%

Credentials among the data compromised 28%

Credential abuse as the initial access vector 13%

Figures from the 2026 DBIR as summarised by Descope. Bar widths equal the stated percentages.

Clearing the session on purpose

The remedy is one setting deep. “To remove saved browser data in the Cloud Browser, open Settings > Cloud browser > Browser data. You can clear data for all sites or clear data for individual sites. Clearing a site’s data signs you out of the website.” That should be a habit after any secure sign-in to a finance, payroll or admin system, not an emergency procedure.

The isolation that works in your favour

One design choice does reduce the blast radius. The cloud browser “does not use your personal browser’s open tabs, browsing history, saved passwords, cookies, extensions, or existing sign-ins”, and OpenAI confirms it will not reuse accounts already signed in on your device: “No. Cloud browser has its own sessions. Sign in separately when prompted.” Compromise of the cloud browser does not hand over your iPhone’s Safari sessions.

Most corporate password policies were written before an assistant could hold a live session. Here is how the familiar rules survive contact with this feature.

The rules that still hold

Unique passwords per service, a manager to generate and store them, a second factor everywhere it is offered, and no credential ever typed into a chat box. OpenAI reinforces the last one directly: “Never paste passwords, security codes, or payment details into the conversation. Use the secure sign-in flow for credentials.”

The rules that need rewriting

Session lifetime, offboarding and audit all change. If a departing employee once completed a secure sign-in to a supplier portal from their personal ChatGPT Plus account, revoking their laptop does nothing about the session sitting in that account’s cloud browser.

Side by side

Control	Traditional browser	ChatGPT secure sign-in
Where the session lives	The managed device	OpenAI’s remote cloud browser
Who can revoke it	IT, via device management	The account holder, in ChatGPT settings
Autofill source	1Password via Password AutoFill	1Password via Password AutoFill
Second factor	Entered by the user	Entered by the user in the secure sign-in form
What acts after login	The user	An agent following instructions from web pages
Audit trail	Proxy and endpoint logs	The conversation, plus the destination site’s own logs

The MFA hygiene gap in the same data

The DBIR numbers on second factors are worse than most boards assume, and they set the baseline any secure sign-in rollout starts from.

Second-factor and credential-leak findings in the 2026 Verizon DBIR

Ransomware victims with an infostealer or credential leak that year 73%

Organisations with an admin account lacking a second factor on IaaS 37%

Third parties that fully fixed missing cloud second factors 23%

Figures from the 2026 DBIR as summarised by Descope. Bar widths equal the stated percentages.

OpenAI shipped more guardrails than the release note advertises, and the defaults are not the safest available.

Website access permissions

Three modes exist. “Always ask: Review every website access request yourself. Auto approve: Let ChatGPT review the URL and only pause to ask you if it seems unsafe. Always allow: Allow access to every website.” OpenAI labels the third one itself: “This is not recommended.” Leave the setting on Always ask for any account that will perform a secure sign-in to a business system.

Consequential actions

Separately from site access, “ChatGPT is designed to request confirmation before actions that could be hard to reverse or create a financial, legal, account, or other real-world commitment, such as confirming a booking or making a payment.” OpenAI is careful to note that allowing a site does not remove that requirement. The two controls stack.

Lockdown Mode

For accounts that should never do this at all, Lockdown Mode is now available to every logged-in user. It “limits access to the web and external services to help reduce the risk of data exfiltration from prompt injection attacks”, switching off “live web browsing, deep research, agent mode, file downloads, and some web-derived image support.” Turning it on removes the secure sign-in question entirely.

Active sessions on the OpenAI account itself

Since 2 June 2026 you can review “first-party OpenAI sessions from Settings > Security > Active sessions, with available details such as device, app, approximate location, sign-in time, trusted-device status, and whether it is the current session.” That is the control for the account holding the cloud browser, and it is worth checking on a schedule.

The honest caveat from OpenAI

The documentation does not oversell any of this. “OpenAI tests for risks such as prompt injection, phishing, and unintended actions. Those safeguards do not eliminate every risk, so review sensitive steps and important results.” Prompt injection remains an unsolved problem, and an agent with a live session is a more attractive target than one without.

A feature that lands on personal Plus accounts does not wait for your rollout plan, so the useful response is a short one.

Decide which systems are off limits

Write the list before anyone asks. Payroll, banking, HMRC, the practice management system, anything holding client money or personal data. A blanket “no secure sign-in to systems on this list” is easier to enforce than a nuanced rule, and it takes ten minutes to agree.

Separate work accounts from personal Plus accounts

The authentication feature is on Plus and Pro. Plenty of staff pay for Plus themselves. That is the route by which a company system ends up behind a personal account with no enforced second factor and no admin visibility, which is precisely the gap the MFA documentation admits to.

Make session clearing part of the task

Treat Settings > Cloud browser > Browser data as the end of the job, not an afterthought. If a task required a secure sign-in to something sensitive, clearing that site’s data afterwards costs one tap and removes the persistent session.

Check the second factor on the OpenAI account first

Before anyone signs into a business system through the assistant, the account performing the secure sign-in should itself be protected by a passkey or an authenticator app, ideally with Advanced Account Security enabled. Since administrators cannot enforce it centrally, this has to be a documented instruction and a spot check.

Bring it into the same review as everything else

This belongs alongside your existing device management, endpoint and identity controls rather than in a separate AI policy nobody reads. The organisations that handle artificial intelligence rollouts well are the ones that route them through the same review as any other tool with production access — the approach we set out in our trust and security commitments, and the same discipline that good managed IT services apply to any new integration.

Pilot it on something harmless

The genuinely useful version of this feature is dull: checking stock on a supplier portal, tracking a shipment, pulling a statement. Start there, watch what the agent does with a live session, and let the evidence rather than the launch coverage decide how far you take it.

Did ChatGPT for iOS really add 1Password support?

Not as a named integration. OpenAI said its ChatGPT Work browser “supports the use of password managers for simple, safe login”, on web and mobile. On an iPhone, 1Password fills that form through Apple’s Password AutoFill, exactly as it fills any other credential field.

Which plans can use the secure sign-in feature?

“Authentication in ChatGPT Work’s browser is available for Plus and Pro plans.” The cloud browser more broadly is available on paid plans in supported regions, excluding Free and Go.

Can ChatGPT see my password?

OpenAI says no. “Credentials entered through the secure form go directly to the remote browser. The username and password entered there are not visible to the model, and ChatGPT does not store those sign-in credentials.”

Does the secure sign-in form handle two-factor codes?

Yes. The cloud browser guide instructs you to “use the secure sign-in form and complete any two-factor authentication steps”, and the release note notes that “You may also need to enter a security code.”

What happens to my session after the task finishes?

It persists. “The authentication will persist for future tasks until it expires, so you do not need to sign in each time.” You can end it manually through Settings > Cloud browser > Browser data, where clearing a site’s data signs you out of that site.

Will ChatGPT use accounts I am already signed into on my phone?

No. The cloud browser “does not use your personal browser’s open tabs, browsing history, saved passwords, cookies, extensions, or existing sign-ins”, and keeps its own separate sessions.

How does OpenAI stop the agent being phished into a fake login?

A second model checks first. “Before presenting a sign-in request, an additional review model checks the request and where your information will be entered for signs of phishing or deception.” You can also inspect the address and the live page before typing anything.

Can my organisation force staff to use two-factor authentication on their ChatGPT account?

Not yet. OpenAI’s own answer is “Not at this time. MFA cannot currently be enforced at the ChatGPT workspace or API Platform organization level.”

Can I switch the feature off completely?

Lockdown Mode is the cleanest route. It disables agent mode and live browsing for the account, which removes the secure sign-in path along with them, and it is available to all logged-in users.