If a Dot signs into a site, who sees the password: you, the browser, or the model?

On a supported sign-in, you see the password because you type it, and the Dot’s browser receives it. The model does not. OpenAI’s privacy FAQ says the Dot pauses while you enter credentials in a secure login form, and that the form sends those credentials directly to the browser environment without exposing them to the model. The computers guide says the same thing in plainer language: the form sends the information to the remote browser outside your conversation. Paste the password into the chat, a document, or a plugin, and that protection does not apply.

A Dot is the always-on ChatGPT agent announced on 29 September 2026, with its own cloud computer and browser, powered by GPT-6 Astra. Signing in on your laptop’s browser does not sign the Dot in. The Dot’s cloud browser has its own sessions. The question is who is in the room when that cloud browser asks for a password.

Who types it, and where does it go?

You type it, or you take over and type it on the site yourself. When a website needs a login, the Dot can send a request with a private form. You enter the credentials there and complete whatever verification the site wants, such as a code. You can instead choose to sign in on the website. That opens the Dot’s browser in takeover mode. You use its mouse and keyboard, finish the steps, and return control when the Dot should continue. Opening the computer view without Take over does not give you that mouse. The handoff is the control.

The model is the part that is supposed to stay outside that form. “Without exposing them to the model” is the privacy FAQ’s line, and it is limited to supported sign-in flows. It is not a claim about every string you type near a Dot. The FAQ lists the paths that are not covered: passwords you share in a chat, in a document, or through a plugin. If you write the password in the message because the form felt slow, you have moved it into the conversation. That is the path the protection declines to cover. Use the form, or take over the browser. Do not narrate the secret.

A verification code is part of the same pause. The FAQ says you may need to provide an authentication code or take over to complete a security check. The model is not supposed to receive the password on the supported form. A code the site texts you is still something you enter. I have not found a sentence that says a code pasted into ordinary chat is hidden from the model. Treat a code like the password: form or takeover, not the transcript.

Does the browser keep the login after you are done?

It can. A website session can remain available for later work until you sign out or the site expires it. That session lives in the Dot’s cloud browser. It is not your personal browser’s cookie jar, and it is not a promise that every site will allow a cloud browser. Some sites block cloud browsers or ask for more verification. If the cloud browser is blocked, you can ask the Dot to try a computer you connected. That may open a separate local task. It does not copy the cloud session onto your machine.

An active session and a saved login are different, and OpenAI says so. The Dot can keep using a valid session without signing in again. Reusing a saved login, when you need to sign in fresh, requires your confirmation. Save to Passwords, when the product offers it, is optional. You can confirm the saved account or enter another one. Custom rules cannot remove that confirmation. They also cannot turn off the requirement that you take over to change a password. A rule that says “never bother me with logins” does not override those built-in stops. Rules are instructions the Dot tries to follow, and OpenAI says they can be wrong. They do not grant access, and they do not rewrite the safety review.

Workspace admins have a separate switch. Under cloud computer capabilities, Use password manager is its own control, not the same as allowing the cloud browser. It lets members use the password manager with Dots and Work Cloud. A Dot’s cloud computer does not inherit your local VPN, your personal browser sign-ins, or your device policies. Reaching a site can still mean signing in on the cloud computer even when the admin has allowed the browser. If your workspace has the password manager off, do not assume Save to Passwords will appear. I am describing the control OpenAI documents, not a button I can promise is on every plan.

What does the model still learn?

That a sign-in happened, and whatever the page shows after it. The model is there to do the task once the browser is signed in. It can see the work product the browser returns into the task: the page it was asked to use, the file it downloaded, the confirmation a form submitted. Hiding the password from the model does not hide the account. If the task is “read this inbox,” the model sees the inbox after the session exists. The privacy property is about the credential string on the supported path. It is not a claim that the Dot works blind.

Plugins are a second door. Existing ChatGPT app permissions apply to the Dot. You can allow read without allowing send. A plugin that connects Gmail is not the cloud browser’s password form. Review the connected account and the actions it allows. If you hand a plugin a password in a setup field that is not the secure sign-in form, you are on the path the FAQ says is uncovered. Disconnecting the app does not delete information the Dot already pulled. Deleting that means deleting the Dot, from the profile menu, Reset, after you read what Reset removes: conversations, saved memories, and scheduled tasks.

Changing a password is not a sign-in. The safety FAQ says the most sensitive actions, changing a password or transferring money, require you to take over and finish them yourself. Other actions, such as permanently deleting data or installing software, may ask every time. An automatic review runs before actions that could affect accounts or share information. It can let the action proceed, require approval, or include a step you must do. You must change a password yourself. That is a different sentence from “the model never saw the password you used to log in.” Both can be true. The login form hides the secret. The change-password page is your hands on the computer.

What should you refuse to do?

Refuse to put the password in the chat, even if the Dot asks in ordinary text. The supported request is the private form or a takeover. A secure secret request, on the products that have one, is the masked field, not a sentence in the thread. I am using OpenAI’s Dot docs for this, not a guess about how a model might be tricked into repeating a secret. Do not experiment with that. If a task wants a password in the message, stop and use the form, or do the sign-in yourself and return control.

Refuse to save a login you would not want every later task on that Dot to be able to confirm. Confirmation is required to reuse it, and a custom rule cannot remove the confirmation, but the saved login is still a credential stored for that Dot’s future sign-ins. Skip Save to Passwords if the account is one you want to type once and forget. Sign out of the site on the cloud computer when the project is over. An expired session is the site’s clock. Signing out is yours.

One personal computer can be connected at a time, and local sign-in is a different browser again. If the cloud browser is blocked and the Dot tries your computer, you may be typing into a local task, with the ChatGPT app open on that machine. The password still should not go through the chat. The computers guide does not say the local task inherits the cloud session, so do not assume a password you typed in the cloud form is now sitting in your laptop’s browser, or the reverse. Check which computer the task says it is using before you type.

Enterprise and Business workspaces can turn cloud browser use on or off separately from the password manager. If the browser capability is off, the Dot cannot get as far as a cloud sign-in form, and the question of who sees the password does not arise there. If the browser is on and the password manager is off, you still type into the form or the takeover. Admins do not, in the pages I read, get a copy of the password because they allowed the browser. They control whether the capability exists. The member still completes the sign-in.

Refuse to treat your laptop browser as the Dot’s browser. They do not share the login. And refuse to treat “the model cannot see it” as “nobody but me can see it.” You see it. The remote browser environment receives it on the supported path. The model is the one OpenAI says is left out of that form. The session that follows is the Dot’s, on its cloud computer, until you sign out, the site expires it, or you reset the Dot.