Can AI agents log in to websites? What works, what’s allowed and what it costs

Yes, AI agents can log in to websites: ChatGPT’s cloud browser, Claude’s computer use, Browserbase and Browser Use fill in sign-in forms and keep the session cookie, though one-time codes and bot checks still need a person. Whether an agent may log in turns on the site’s terms and on computer misuse law, which US courts still apply to agents case by case. Obsession keeps each company’s emails, texts, member prices and offers behind the login, dated with a screenshot, so agents look them up by API or MCP (the standard way AI agents call tools) without anyone’s password.

Yes, AI agents can log in to websites. ChatGPT’s cloud browser, Claude’s computer use, Browserbase and Browser Use fill in sign-in forms, keep the session cookie the site sets and come back later without signing in again. A one-time code, a bot check or an expired session still sends the run back to a person.

Logging in is a check that happens once, at the start. The site checks a password, and often a code, then stores a small token called a session cookie in the browser. The browser sends that cookie with every later request, so the site knows who is asking. The internet standard for cookies describes them as a way for servers to “maintain a stateful session over the mostly stateless HTTP protocol” (RFC 6265).

An agent that logs in therefore has to pass the sign-in, keep the cookie and cope when the site asks again. The products differ on each step, and the site’s terms and the law decide whether the agent should be there at all.

Most agents act as a person inside that person’s own account. Another kind holds an account of its own at the company, as a customer that says it’s an AI. The web behind the login explains what each kind can reach, and the guide to how teams scrape data behind a login covers the code.

How AI agents log in to websites today

ChatGPT’s cloud browser

OpenAI’s cloud browser gives ChatGPT Work “its own browser on a separate computer in the cloud” (OpenAI Help Center). It reads pages, clicks buttons and fills in forms on public and signed-in websites. When a task reaches a sign-in page, it pauses and asks the person to sign in through a secure form, including any two-factor code. OpenAI says the username and password entered there go straight to the remote browser, are “not visible to the model”, and aren’t stored by ChatGPT.

The session then persists for later tasks until it expires. The cloud browser keeps its own cookies and never uses the person’s own browser, saved passwords or existing sign-ins. By default it asks before visiting a new website, and it asks for confirmation before a booking, a payment or another step that is hard to reverse. It runs on paid ChatGPT plans, excluding Free and Go.

Claude’s computer use

Anthropic’s computer use gives Claude a toolset of 17 actions, such as taking a screenshot, clicking and typing, and the developer runs each action on a machine they control (Anthropic’s docs). Claude sees the screen through screenshots and chooses the next click, so it signs in the way a person at that desktop would. For tasks that stay inside webpages, Anthropic points developers to its browser use tool.

Anthropic’s documentation warns that Claude may follow instructions it finds on a webpage, and tells developers to isolate it from sensitive data and actions. It advises against tasks that need “sensitive user information without human oversight”. For passwords, 1Password announced an integration with Claude on 16 July 2026. A person approves the logins a task needs with one biometric prompt, and “the password and the MFA one-time code are never accessible to the model” (1Password).

Browserbase, Browser Use and Firecrawl

Browserbase runs browsers in the cloud for code to drive. Its Contexts keep cookies, localStorage and IndexedDB between sessions, encrypted at rest. A later session that loads the same Context starts signed in (Browserbase docs). Its documentation warns that sites can still force a logout, for example after a password change or suspicious activity, and that 2 sessions sharing one Context at once can trigger one.

Browser Use keeps logins in profiles: “A profile persists cookies, local storage, and login state across browsers” (Browser Use docs). For two-factor prompts, its guide names “a saved profile or a human checkpoint” as the most reliable options (Browser Use docs). At a checkpoint, a person types the code into a live view of the browser.

Firecrawl turns pages into clean text for AI models. Its Interact feature can “sign in once, then read the pages that only appear after authentication”, and saves cookies and localStorage to a named profile for later scrapes (Firecrawl docs).

How an agent stays logged in: cookies, tokens and codes

The session cookie is the agent’s pass after sign-in. RFC 6265 lets a site set its lifetime with Max-Age or Expires, and notes that browsers often evict cookies sooner. An HttpOnly cookie is hidden from scripts on the page, and an agent driving a real browser never needs to read it, because the browser attaches it to every request by itself.

The same standard names the main risk of a logged-in agent. It calls cookies “a form of ambient authority”, because a browser attaches them even when another site triggered the request. An agent that reads a page carrying hidden instructions still holds the user’s session when it acts. OpenAI and Anthropic call those hidden instructions prompt injection. OpenAI tests its cloud browser against them, and Anthropic scans computer use screenshots for them.

OAuth, the standard for giving an app access to an account without handing over the password, exists because sharing passwords goes wrong. Its RFC lists how (RFC 6749). The app has to store the password, gains “overly broad access”, can be cut off only by changing the password, and exposes it if the app is breached. OAuth replaces the password with an access token limited in scope and lifetime. Where a site offers only a sign-in form, an agent is back to typing a password, which is why OpenAI and 1Password route it through channels the model can’t read.

Multi-factor authentication (MFA) asks for a second proof after the password, usually a one-time code. An authenticator app makes a time-based code (TOTP) from a secret shared with the site, and RFC 6238 recommends a new code every 30 seconds (RFC 6238). An agent can make that code itself only if it holds the secret, and Browser Use’s guide says never to put passwords or TOTP secrets in a prompt. A code sent by text needs a phone number that receives it, or a person who reads it out.

NIST’s digital identity guidelines explain why a code can be passed to an agent and a passkey can’t. Codes a person types are not phishing-resistant, because “the manual entry does not bind the authenticator output to the specific session being authenticated” (NIST SP 800-63B-4). The same property lets a person read a code to an agent. WebAuthn, the web standard that passkeys use, ties each sign-in to the site’s domain name, so there is no code to pass on. The person’s device or password manager has to approve every passkey sign-in.

Why bot checks and CAPTCHAs stop agents

A CAPTCHA, a “Completely Automated Public Turing Test, to Tell Computers and Humans Apart”, exists to tell software from people (W3C). An agent is exactly what it is built to catch. The same W3C note says sites keep these checks even for signed-in users, because “even authenticated login provides inadequate protection from malicious actors”.

Many checks now run without a puzzle. The note describes Google’s reCAPTCHA v3, released in 2018, which returns a score for how likely a visitor is to be human, without “the need to interrupt users with challenges at all”. Where the score is unclear, the note quotes Google advising sites to add a second challenge, such as two-factor authentication.

OpenAI’s help page says some websites restrict automated browser agents, and that “each website ultimately decides whether to allow cloud browser traffic”. Some browser providers list ways past these checks. Browserbase’s paid plans list automatic CAPTCHA solving and stealth modes (Browserbase pricing). Browser Use lists CAPTCHA solving as included, and routes traffic through home IP addresses rather than data centres (Browser Use pricing). Whether getting past a site’s check is allowed depends on that site’s terms and on the law where each side is.

The cooperative route is for the agent to say who runs it. Web Bot Auth, a signature that tells a website which company’s agent is visiting, does that. Each request is signed with a private key under the HTTP Message Signatures standard (RFC 9421). The site checks the signature against a public key the agent’s operator publishes (Cloudflare docs). OpenAI’s cloud browser sends a Signature-Agent header naming chatgpt.com with each request and publishes its keys at a fixed address on chatgpt.com (OpenAI Help Center). A site, or the network that serves its pages, can then verify the traffic and allow it.

A signature identifies the company running the agent. The person behind it stays unknown to the site. The IETF working group writing the Web Bot Auth standard says it “will focus on authentication of the agent; authentication of the end user is out-of-scope” (IETF). A signed agent still has to log in like anyone else, and a site can recognise it and still refuse it. Site owners choosing what to allow will find the checks in agent ready website.

Is it legal for an AI agent to log in to a website?

Whether an agent may log in usually turns on the site’s terms, on whether computer misuse law treats the access as authorised, and on whose account it is. Each point here names the place it applies. It is general information, not legal advice.

The site’s terms come with the account

Opening an account usually means accepting the site’s terms, and terms can set rules on automated access. An agent signed in to that account acts under them. In August 2026 the US Court of Appeals for the Ninth Circuit lifted an injunction against Perplexity’s shopping agent. It noted that its ruling “does not impair Amazon’s ability to regulate access to Amazon.com via private terms of service for its users” (Amazon v. Perplexity, Ninth Circuit).

US: the Computer Fraud and Abuse Act

The Computer Fraud and Abuse Act (CFAA) is the main US federal law on computer access. It covers anyone who “intentionally accesses a computer without authorization or exceeds authorized access” and obtains information from a protected computer, and it lets people who suffer loss sue (18 U.S.C. §1030).

In Van Buren v. United States in 2021, the Supreme Court read the law as a “gates-up-or-down inquiry” (Supreme Court). A person either can or cannot access a computer system, or a part of it. The Court left open whether the gate has to be technical, or can also be set by contracts and policies.

A login is the clearest gate. In hiQ Labs v. LinkedIn in 2022, the Ninth Circuit concluded that “the concept of ‘without authorization’ does not apply to public websites”. It quoted the view that “an authentication requirement, such as a password gate, is needed to create the necessary barrier that divides open spaces from closed spaces on the Web” (hiQ v. LinkedIn, Ninth Circuit). It added that parts of a public site that require authorisation are different.

The same opinion recalls an earlier case that looks much like a password-holding agent today. Power Ventures collected Facebook users’ data after the users gave it their Facebook usernames and passwords. Facebook sent Power Ventures an individual cease-and-desist letter, Power Ventures kept working around Facebook’s IP blocks, and the court held that its continued access was “without authorization”.

The first appeal about a shopping agent came in 2026. Amazon sued Perplexity over the AI assistant in its Comet browser, which shops on Amazon.com at the user’s direction. The court said the core of the dispute was Perplexity’s decision not to use a user-agent string “that would communicate that the user has activated an AI agent”. A user-agent string is the line of text a browser sends to say what it is. After a hearing in March 2026, a district court granted Amazon a preliminary injunction.

On 4 August 2026 the Ninth Circuit vacated that injunction. On the facts before it, “It is the user who ‘accesses’ Amazon’s computers, with the help of the Assistant”, so Amazon was unlikely to show that Perplexity had accessed them. The court left open whether a developer’s control over an agent could amount to access on other facts. It did not reach the rest of the CFAA claim, and it sent the case back to the district court.

UK: the Computer Misuse Act

In the UK, section 1 of the Computer Misuse Act 1990 makes it an offence to use a computer to secure access the person knows is unauthorised (legislation.gov.uk). Section 17(5) treats access as unauthorised where the person is not entitled to control it and has no consent from someone who is (legislation.gov.uk). Whether an account holder’s permission is enough, once the site itself has said no, is a question for a lawyer.

When to ask a lawyer

Ask a lawyer where your company and the site operate before any of these:

• Someone else’s account. A client’s or a colleague’s login, even with their permission, where the site’s terms limit who may use it.
• A site that has said no. A cease-and-desist letter, a block or a changed setting, after which continued access looks like Power Ventures.
• Getting past a bot check. Solving or avoiding a CAPTCHA or another check the site put in front of a step.
• Changing how the agent identifies itself. Altering its user-agent string, or anything else that tells a site what it is, after a site has blocked it.
• Other people’s data. Accounts that hold customers’ or employees’ details, where data protection law adds duties of its own.
• More than one country. An agent run from one country on a site in another, where both sets of rules can apply.

What it costs to run an agent that logs in

Most of the bill is the model reading screenshots, step after step. Anthropic’s docs say declaring the computer use tools adds about 4,500 input tokens to each request, and each screenshot is billed as an image. An image costs one token per 28 by 28 pixel patch, so a 1280 × 800 screenshot is about 1,334 tokens (Anthropic’s docs).

Take a run that opens a saved session, checks 3 pages and reads an offer in 25 steps. Say each step sends about 12,500 tokens and returns 250. The tokens sent cover the tools, the 3 latest screenshots and the instructions and history so far. On Claude Sonnet 5.5, at $2 per million input tokens and $10 per million output (Anthropic pricing), that is about $0.69 of model time. Five minutes of Browserbase at its $0.12 hourly rate adds about a cent. On Claude Haiku 5.5, at $0.10 and $0.50 per million, the same run costs about 3 cents, if it completes the task as reliably.

At volume the run price compounds. Checking 10,000 companies a week at $0.70 a run is about $7,000 a week, or about $364,000 a year, before retries. At 1,000 companies it is about $700 a week, and at 100 about $70. Prompt caching cuts the repeated part of each request, and dropping old screenshots from the history cuts more.

The larger cost is people and upkeep. Every one-time code, new-device check and expired session pauses a run until someone steps in, and Browserbase’s docs tell developers to detect logged-out states and sign in again. Across thousands of accounts, those pauses become a staffing question as much as a token bill.

Ways to give an agent access behind a login

We make Obsession, so every other option is described from its provider’s own pages as of 11 November 2026.

For what companies show their customers, across many companies and for months, use Obsession. It holds its own account at each company and returns every email, text, price and offer dated with a screenshot. For acting inside a person’s own account, use ChatGPT’s cloud browser, or Claude with a password manager that keeps the password from the model. For many browsers driven by your own code, Browserbase and Browser Use keep sessions in Contexts and profiles. For a handful of accounts checked now and then, a person signing in is enough.

The other route: a customer of its own

Obsession collects what companies show only to customers, step by step: their screens, emails and texts, member prices, trial limits, quotes and cancel offers, each dated with a screenshot. Teams and AI agents look up any company through the API or MCP, and a company not yet covered is added on request.

Each Obsession agent signs up with its own inbox, phone number and browser, says it’s an AI when it talks to a person, and keeps the account open for months (Obsession agents). The account is its own, so nobody lends it a password and no colleague waits up for a code. Every email and text the company sends lands in its inbox, dated, for as long as anyone follows that company.

Search APIs give agents what companies publish. Exa describes itself as searching “the largest index of public web and private information” (Exa), and the guide to web search APIs for AI agents compares it with the rest. Obsession gives agents what a company shows only to its customers, behind the login, dated, and kept for as long as anyone follows the company. Agents call both: search for what a company publishes, and Obsession for what it sends and shows its customers.

Developers reach it with 5 verbs (lookup, facts, evidence, index and notify) over the API, MCP and the TypeScript and Python SDKs. Each new fact can post to a webhook, an address in your app that receives it the moment it lands (the API and MCP). Obsession’s agents have run 1,500 sign-ups, baskets and checkouts at real companies, and counting. If your agents need what companies show their customers behind the login, at any company you name, use Obsession.

Questions about AI agents and logins