What an AI Agent Sees When You Share a Card or Password

Short answer: if you type a password or card number into the chat, the model sees it, because everything in the chat becomes part of its context. If you enter it in a secure sign-in form, like the one in ChatGPT's cloud browser, or a password manager fills it in after you approve, the value goes straight to the website and, according to the vendors' documentation, the model never reads it. Whether an agent sees your secret depends less on which agent you use and more on which path the data takes.

I use AI agents every day, and the question I hear most is "can the agent see my password?" Below is what the official documentation from OpenAI, Anthropic, 1Password and Bitwarden says today, and nothing it doesn't. All sources were checked on October 24, 2026.

What happens when you paste a password into the chat?

The chat is the model's input. Whatever you type there, it reads. 1Password puts it plainly: when people hand credentials directly to a browser-use AI app, they may expose them to the agent and the underlying LLM, scattering secrets across agents, prompts and logs (1Password).

The vendors themselves warn against it:

• OpenAI: "Never paste passwords, security codes, or payment details into the conversation. Use the secure sign-in flow for credentials." (OpenAI Help)
• Bitwarden: "We do not recommend inputting sensitive credentials directly into LLMs or AI agents." (GitHub)
• Google, on Gemini: "Please don't enter confidential information that you wouldn't want a reviewer to see or Google to use to improve our services." (Gemini Apps Privacy Hub)

What does ChatGPT see when you use its secure sign-in form?

ChatGPT Work's cloud browser pauses when it reaches a supported sign-in page and asks you to sign in through a secure form. According to OpenAI (OpenAI Help):

• Credentials entered in the secure form go directly to the remote browser. The username and password are not visible to the model, and ChatGPT does not store them.
• Before you're asked to sign in, an additional review model checks the request for signs of phishing, and you see the site address and a preview of the form.
• Before actions that are hard to reverse, such as confirming a booking or making a payment, ChatGPT asks for confirmation in the chat.

One catch: the signed-in session persists for future tasks until it expires. You can end it earlier by clearing that site's data under Settings > Cloud browser. OpenAI also notes that on iOS you can sign in with a supported password manager (ChatGPT Learn).

What does Claude in Chrome allow with sensitive data and cards?

Anthropic's permissions guide (Claude Help Center) sets two rules that apply in every permission mode:

1. Explicit permission before entering potentially sensitive information into a website, even on sites you've marked "always allow."
2. Prohibited actions, including making purchases or financial transactions and handling sensitive credit card or ID data.

For work involving money, messages sent as you, or important files, Anthropic suggests staying close or switching back to manual approval. The guide doesn't say whether the model sees a value you authorize it to enter, so I won't claim either way.

How do password managers work with agents?

Here neither you nor the agent types the secret. The password manager fills it in after a human approves.

1Password. Secure Agentic Autofill injects credentials into the browser through the 1Password browser extension, only when needed and always authorized by a person. 1Password says raw credentials never enter the LLM context and travel over an end-to-end encrypted channel built on the Noise Framework (1Password). It has been in early access since October 8, 2025, for 1Password customers using Browserbase (press release, Marketplace). On October 22, 2026, 1Password also announced 1Password for Agents: the agent requests a credential, you approve it, and 1Password fills it into the site so the agent doesn't have access to it. It's currently available for Individual and Family accounts on 1Password.com, and availability and capabilities vary by integration (1Password).

Bitwarden. On March 24, 2026, Bitwarden released the Agent Access SDK, an open protocol under the Apache 2.0 license. You approve specific credentials only when a task needs them, instead of exposing your whole vault, with end-to-end encryption and human approval. For now it runs from the command line: the run subcommand injects the credential as environment variables into a child process, and a browser extension is listed as coming soon (Bitwarden). The blog calls it an early alpha and recommends testing with sample data only; the repository calls it an "early preview" and recommends environment injection to keep secrets out of recorded context (GitHub).

Side-by-side

A practical checklist

• Never paste passwords, codes or card numbers into the chat.
• Use the secure sign-in form when the agent offers one, and check the site address first.
• Read every payment or booking confirmation before you approve it.
• End the agent's session when you're done. In ChatGPT, clear the site's data under Settings > Cloud browser.
• Use manual approval for tasks involving money or messages sent as you, as Anthropic recommends.
• Use a password manager with a unique password per account. The UK's NCSC notes that autofill also helps against phishing, because the password only fills on the correct website (NCSC).
• Turn on two-step verification and use passkeys wherever they're offered, as the NCSC recommends.
• Treat early-access and alpha integrations as experimental.

Before I share anything with an agent, the question I ask isn't "do I trust this agent?" It's "does this value pass through the model's context?" If it does, I look for another route.

FAQ

Can an AI agent see my password if I type it into the chat? Yes. Anything in the chat is part of the model's context. OpenAI and Bitwarden both advise against it.

Does ChatGPT see the password I enter in its secure sign-in form? According to OpenAI, no. It goes directly to the remote browser and isn't stored by ChatGPT. The session can stay active until it expires.

Can Claude in Chrome pay with my credit card? No. It's prohibited from making purchases and handling sensitive card data in every permission mode.

Can I use my password manager with an agent without exposing the password? There are early-stage options: 1Password Secure Agentic Autofill (early access), 1Password for Agents (announced October 22, 2026) and Bitwarden's Agent Access SDK (early alpha). In each, a person approves every use.

Sources

Checked October 24, 2026.

• OpenAI Help Center, Using cloud browser in ChatGPT
• ChatGPT Learn, Browser
• Claude Help Center, Claude in Chrome permissions guide
• 1Password, Closing the credential risk gap for AI agents using a browser
• 1Password, 1Password and Browserbase Partner to Secure Credential Access for Agentic AI Automation (Oct 8, 2025)
• 1Password Marketplace, Secure Agentic Autofill for Browserbase (Early Access)
• 1Password, Introducing 1Password for Agents (Oct 22, 2026)
• Bitwarden, Introducing the Agent Access SDK (Mar 24, 2026)
• GitHub, bitwarden/agent-access
• Google, Gemini Apps Privacy Hub
• UK NCSC, Managing your passwords (reviewed May 21, 2026)