What Is the Cloud Browser in ChatGPT?
If you are asking what is cloud browser in chatgpt, picture a browser window running on a machine in OpenAI’s cloud instead of on your desk. ChatGPT drives it inside a task: it opens pages, reads them, clicks, fills forms, and can sign in to supported sites through a secure credential form. It keeps its own cookies, files and signed-in sessions, and it never touches your local tabs, history, passwords, extensions or existing logins.
📌 TL;DR Executive Summary
- Core Takeaway: The cloud browser is a remote browser ChatGPT drives for you. It has its own cookies, filesystem and signed-in sessions, and stays separate from the browser on your machine.
- Key Risk/Challenge: Your password is isolated in a secure form, but the authenticated session persists until it expires or you clear it — and every page the browser reads is untrusted input.
- Recommended Solution: Keep website access on “Always ask”, allow only the domains a task needs, clear site data when the task ends, and keep client logins in isolated profiles rather than one shared assistant session.
How the Cloud Browser Works Under the Hood
You cannot launch the cloud browser, and there is no button that forces it. ChatGPT chooses per task between a connected app, a plugin, the cloud browser, or a combination. That matters when you audit what happened, because the transcript shows the outcome rather than always showing the route.
The browsing itself runs on a separate computer in the cloud with its own filesystem. Files downloaded during a task come back to you in the chat instead of landing in a local Downloads folder, and nothing it does writes into your machine’s browser profile. The reverse holds too: your bookmarks, saved passwords and extensions are invisible to it. Our explainer on how cloud browsing works covers the general trade-offs of running a browser somewhere other than your desk.
Three browsing surfaces, three different states
ChatGPT can reach the web in three distinct ways, and they do not share state. A session you build in one is not available in another.
| Surface | Where it runs | What it sees | Sign-in behaviour |
|---|---|---|---|
| Cloud browser | OpenAI’s cloud infrastructure | Pages you approve, with its own cookies and filesystem | Secure credential form; the session persists until it expires or you clear it |
| Desktop built-in browser (July 2026) | Your Mac or Windows machine, inside the ChatGPT app | The tabs you open and watch | Uses the sessions you create in that window |
| ChatGPT browser extension | Your existing Chrome, Edge, Brave, Opera or Vivaldi profile | The active tab in the profile you already use | Acts on accounts already signed in there |
Choose deliberately. The cloud browser suits tasks you want to run from anywhere, including your phone. The desktop browser suits work you want to watch. The extension is the surface that touches the identity you browse with every day, so it deserves the most caution before you point it at anything work-related. Once you know what is cloud browser in chatgpt, the practical question becomes what that browser is allowed to touch, because the three surfaces above never share state.
Web Bot Auth: how sites recognise the traffic
OpenAI published allowlisting guidance on 14 October 2026: cloud browser requests are now signed with Web Bot Auth, using the HTTP Message Signatures standard (RFC 9421). Each outbound request carries Signature, Signature-Input and Signature-Agent headers, and the public keys sit in a well-known directory on chatgpt.com. CDNs can verify them — Akamai and HUMAN recognise the bot name “ChatGPT Agent”, Cloudflare uses the bot tag chatgpt-agent with detection ID 129220581, Vercel needs no configuration, and other providers verify the signature headers directly. OpenAI’s allowlisting notes list the header details.
Two practical consequences. A site that blocks automated browsers is still a block: that restriction is set by the website, and no ChatGPT setting overrides it. And capabilities move faster than documentation. The allowlisting note still carries a launch-era limitation about signing in and completing payments, while the help page on using cloud browser describes the secure sign-in flow. Check the current page for your own workspace rather than trusting any older summary, including this one.
Secure Sign-In: What Is Isolated and What Persists
When a task reaches a login page on a supported site, ChatGPT pauses and hands you a secure form. A separate review model checks the sign-in request and its destination for phishing or deception before the form appears. What you type goes directly to the remote browser: the model does not see it, and it is not stored.
The catch is what the form does not protect. A password and a session cookie are different secrets. Once you authenticate, the cloud browser holds a live signed-in session that persists for future tasks until it expires or you clear it — and every later task in that browser inherits the access.
You control how long that state lives. In Settings → Cloud browser you can clear browser data for a single site or for all of it, and clearing the site you just finished with is the cheapest risk reduction available. Where several people share a workspace, agree on who may approve a client sign-in before it happens, and keep the platform’s own account rules in view — our notes on sharing a ChatGPT account explain what changes when a seat stops being personal.
What the Cloud Browser Changes for Your Team
Cloud browser changes what is worth delegating. Support teams can have an assistant open a queue and pull the details of a ticket. QA teams can walk a signed-in flow and report where it breaks. Analysts can gather public pages into one summary without opening thirty tabs. Those are read-heavy tasks with a clear end state, which is where a remote browser earns its keep. If a colleague asks what is cloud browser in chatgpt, that is the practical answer: a browser that runs the task somewhere other than their desk, under permissions their workspace sets.
The group with the most at stake is anyone running client accounts side by side. When one assistant browser carries sessions for several properties, a mistake in one task becomes a mistake in a shared context. Governance, not features, is the limiting factor:
- Which domains are allowed, and under which permission mode.
- Who may approve a sign-in on a client’s behalf.
- Which tasks stay human: payments, publishing, anything irreversible.
- When site data is cleared, and who checks that it happened.
Run What Is Cloud Browser In Chatgpt in the Cloud With Send.win
Send.win’s cloud browser runs isolated browser profiles on a server in the EU — open a clean session from any device without installing anything:
- Instant cloud sessions – launch an isolated browser in seconds, no local install
- Isolated profiles – separate cookies, storage and fingerprint settings per session
- Cloud sync & profile sharing – pick up the same profiles on the desktop app (Windows, macOS, Linux) or share them with your team
- Residential proxies included – on Pro and Team, with timezone and locale matched to the proxy
You can try it right now: the Send.win demo browser opens an isolated cloud session directly in this browser tab. Paid plans start at $19/month, with a 7-day money-back guarantee on your first card purchase — see pricing.
Then weigh the failure modes. Research presented at Black Hat in August 2026 reported that every AI browser tested was vulnerable to indirect prompt injection, with data exfiltration and account takeover among the outcomes. Separately, ChatGPT Work webhooks now fire on Gmail, Slack or GitHub events instead of polling on a schedule, which turns an incoming message into an input that can carry instructions. The direction of travel is more autonomy: the Dots agents OpenAI announced at DevDay 2026, rolling out to Pro and Business Premium users in eligible markets, each get their own cloud computer. Every additional agent is another browser state to account for, so treat every page the browser reads as untrusted content and keep signed-in sites to the minimum a task needs. Teams running many identities usually separate them at the profile layer — a cloud browser for teams explains how that structure holds up in daily use.
How to Set Up the Cloud Browser: A Practical Checklist
Knowing what is cloud browser in chatgpt is the easy part; the settings do the real work. Availability comes first. OpenAI lists the cloud browser for paid work plans in supported regions, with Free and Go excluded, and access can vary by rollout and by workspace permissions. If the settings are missing from your account, the feature is probably not enabled for your seat yet — that is a rollout fact, not a misconfiguration you can fix.
- Open Settings → Cloud browser before your first task. Review the three controls: website access, per-site allow or block, and the browser-data clearing options.
- Leave website access on Always ask. It is the documented default, and it keeps you in the loop at the moment a page loads.
- Add entries only for the domains the task needs. Permission is granted per site, not per task, and crossing to a different domain triggers a second request before the page loads.
- Start with a read-and-report task. Summarise a page, extract a table, draft a reply: no sign-in, no consequence, nothing to undo.
- Read the credential form when it appears. Confirm the domain matches the site you intended before you type anything.
- Stay present for consequential actions. ChatGPT asks for confirmation before things like confirming a booking or making a payment, and you are still the person who decides.
- Use the hand-over when the agent stalls. It will ask you to take over, or you can request a link and drive the browser yourself.
- Clear site data when the task ends, and keep the allowlist short. Review it monthly and remove sites you no longer use, because a stale approval is a standing grant.
If your work involves verifying signed-in behaviour, apply the same discipline testing websites in isolation requires: one identity per test, and no leftovers afterwards.
| Website access mode | What you get | Trade-off |
|---|---|---|
| Always ask (default) | A prompt before each new site loads | Slower tasks that touch many domains |
| Auto approve | Fewer interruptions once a flow is familiar | Less review at the exact moment a page loads |
| Always allow | Broadest access, no prompts | OpenAI marks this option as not recommended |
Common Mistakes That Create Risk
- Treating the secure form as the end of the risk. The password is protected; the session is not. Plan for the session, not just the login.
- Leaving sessions alive for convenience. “I’ll need it again tomorrow” turns a one-off approval into standing access to a client account.
- Switching to Always allow to move faster. You save a few clicks and give up the review that makes the feature safe to use at all.
- Assuming permission applies to the task. It applies to the site. A redirect to another domain starts the permission process again, which is a feature, not friction.
- Expecting a blocking site to work. The block belongs to the website, and no permission setting changes that.
- Confusing the three surfaces. Cloud browser, desktop built-in browser and the Chrome-family extension keep separate state, and the extension acts on the profile where your personal logins already live.
- Letting a task run unattended into a payment or a publish, or handing one workspace seat to several staff. Confirmation prompts assume someone is watching, and shared seats make approvals and data clearing nobody’s job.
Keeping Client Logins Out of One Browser
ChatGPT’s cloud browser answers the question “let an assistant do this task”. A second question sits underneath it: how do you keep the many identities your team works with out of one browser? Whatever the answer to what is cloud browser in chatgpt looks like in your workspace, the client logins you manage still need separate homes. That is the problem a browser profile manager such as Send.win solves. Sendwin Browser gives each profile its own cookies, storage, sessions, fingerprint settings and proxy, so a client login in one profile is not sharing a cookie jar with the next client’s. Fingerprint settings are handled inside the browser engine, per profile, as privacy protection — the same idea as the fingerprinting protection in Firefox or Brave, applied per profile instead of per browser.
Those profiles run two ways. The desktop app installs locally on Windows 10/11 (64-bit), macOS 12+ (Apple Silicon and Intel) and Linux (AppImage or .deb), and is built on Chromium. The cloud browser runs profiles on Send.win’s server in Helsinki, Finland, from any device with nothing to install — practical when a contractor needs one client profile and nothing else. Sharing happens at profile level: share a profile with a paid teammate and it opens already signed in, with no password changing hands, and cloud sync makes the login follow you across devices. Residential proxies are included on Pro and Team on metered bandwidth, bring-your-own HTTP/SOCKS5 is supported, timezone, locale, WebRTC and geolocation follow the proxy’s exit IP, and up to 50 profiles can be open at once.
What it is not: Send.win is a hands-on browser, not a tool you control from code. Every profile is opened, signed into and used by a person, and nothing runs a profile on your behalf in the background. It does not drive ChatGPT or any other site, and it is not a route around a site that restricts automated traffic. It is for accounts you own or are authorised to manage, used in line with each platform’s terms.
🏆 Send.win Verdict
ChatGPT’s cloud browser is a good fit for a task you want an assistant to run on a site you approve — and a poor home for standing access to client accounts, because the session outlives the task that created it. Send.win covers the other half of the problem: separate profiles with their own cookies, storage, sessions, fingerprint settings and proxy, run either in the desktop app or from the EU cloud server, so each client identity stays in its own container and a shared profile opens already signed in for the teammate who needs it.
See Send.win plans — Pro $19/mo (or $83.88/yr, $6.99/mo) with residential proxies included, or start with the free cloud demo: 10 minutes a day, nothing to install. The desktop app itself needs Pro or Team, and your first card purchase is covered by the 7-day money-back guarantee.
Frequently Asked Questions
What is a cloud browser in ChatGPT?
It is a browser that runs on a separate computer in OpenAI’s cloud rather than on your device. ChatGPT drives it as part of a task: reading pages, clicking, filling forms and, on supported sites, signing in through a secure credential form. It carries its own cookies, filesystem and signed-in sessions, so it does not use your local tabs, history, passwords, extensions or logins.
Can ChatGPT sign into websites using my password?
On supported sites, yes — through a form you fill in yourself. What you type goes directly to the remote browser; the model does not see the credentials and they are not stored. Some sites remain off limits because the website blocks automated browsers, and availability also depends on your plan, region and workspace permissions.
Does ChatGPT store my login credentials?
Not the credentials themselves. It does keep the authenticated session: once you have signed in, that access persists for future tasks until it expires or you clear the data. Clearing one site or everything is available in Settings → Cloud browser, and doing it after a sensitive task is the simplest control you have.
How do I turn off the cloud browser in ChatGPT?
There is no single on/off switch documented in Settings. What you control is access: set website access to Always ask, block individual sites, or clear browser data from Settings → Cloud browser. Whether the feature is available to your seat at all is managed at workspace level, and availability varies during rollout and by region.
Is ChatGPT’s cloud browser the same as my browser?
No. It runs on OpenAI’s infrastructure with its own filesystem, cookies and browser data. Files a task downloads come back to you in the chat rather than to a local folder, and your own browsing profile is not read or modified by it. Sessions do not transfer between the cloud browser, the desktop app’s built-in browser and the ChatGPT extension.
Can ChatGPT’s cloud browser make purchases on its own?
It asks you to confirm before consequential actions such as confirming a booking or making a payment. OpenAI’s allowlisting documentation still lists completing payments as a launch-era limitation, so treat payment steps as human work regardless of what a task summary claims, and never let a checkout flow run unattended.
What happened to the ChatGPT Atlas browser?
Atlas was OpenAI’s Chromium-based browser for Macs with Apple silicon running macOS 14.2 or later, launched on 21 October 2025. OpenAI announced its retirement on 9 July 2026, and it stopped working on 9 August 2026, with its features moving into ChatGPT and Codex. Ignore any guide that still tells you to download it.
How can website owners allowlist ChatGPT’s cloud browser?
They verify the Web Bot Auth signatures that cloud browser requests now carry under RFC 9421, using the Signature, Signature-Input and Signature-Agent headers and the public keys published on chatgpt.com. Most CDNs already expose an entry: Akamai and HUMAN call it “ChatGPT Agent”, Cloudflare uses the bot tag chatgpt-agent with detection ID 129220581, and Vercel needs no configuration.