Login pages and CAPTCHAs are not routine prompts for an agent to improvise around. They mark boundaries where a website expects a human credential holder, an additional challenge, or an explicit trusted automation interface. A browser workflow should plan how to stop safely instead of treating every interruption as a failure to overcome.
What to classify before browsing
Sort the job into public reading, authenticated reading, account changes, and financially or legally consequential actions. Public reading may need no account access; an internal reporting portal may require a scoped service identity; changing a bank account or signing an agreement needs human authorization. The operator should know which category applies before receiving credentials or opening the browser. This is more precise than a blanket rule allowing any click after a single sign-in.
A safe login handoff
Create a new isolated session and navigate only to the verified destination. When the site requests a credential or multi-factor challenge, transfer control to the authorized person without sending secrets through model prompts. After the person completes authentication, the agent can resume narrowly scoped work. Rotate or discard the browser context afterward according to retention policy. Never infer that possession of a session cookie gives permission to transfer money, send messages or view another tenant’s data.
CAPTCHA is a stop signal, not a benchmark
CAPTCHAs may be anti-abuse and account security controls. Repeated attempts to solve or route around them can conflict with site policy and make the workflow unreliable. Prefer an approved API, formal business integration or manual completion. If no permitted route exists, report the obstruction with the target step and what was not completed. Do not disguise a partial run as success or use third-party challenge-solving services without clear authorization and contractual review.
Specific test cases
Rehearse expired sessions, unexpected redirects, lookalike login domains, sudden MFA prompts, permission-expired pages, permission elevation requests and a site asking to download an unknown extension. Inject a fake instruction into a harmless test webpage that demands sending credentials elsewhere; confirm the action layer rejects it. Record the approval identity and session state without leaking cookies or security codes into central traces.
Operational limits
Authentication flows vary by market, platform and enterprise identity provider. Conditional access, geofencing, privacy screens and step-up authentication can interrupt a nominally identical run. Build the agent to pause, escalate and resume with an explicit expiry. This guide describes robust application behavior rather than promising CAPTCHA compatibility, unrestricted access or an automation product’s current regional coverage.
Choose a supported integration path
For a frequently repeated authenticated workflow, ask the provider about delegated OAuth, a documented integration, service accounts or a signed enterprise agreement. A human signing into a remote browser can be appropriate for occasional supervised tasks; it is not a scalable replacement for a stable and legitimate access mechanism. The ability to view a page after a user logs in does not grant the ability to scrape everything in the account.
Production acceptance and review test
Include a security drill in which the portal asks for an unexpected extra authentication factor, redirects to a suspicious lookalike and changes the transaction target after sign-in. A passing agent does not invent a workaround or silently continue; it labels the incomplete step, asks the user for appropriate action and does not leak the challenge text, credentials or full browser state into third-party logs.
Scope, version and availability
Features documented by a current vendor page are not assumed to have existed in earlier releases. Where a historical launch date is provided, it is supported by a dated first-party publication. Exact subscription tier, market availability, quotas, API billing, licensing permissions and deployment regions are not asserted without a directly applicable record. This is researched editorial guidance rather than a claim of independent hands-on testing, deployed operation or statutory certification.
Sources and Further Reading
- OpenAI — Introducing Operator (source reviewed 2026-10-25)
- Anthropic — Computer use tool (source reviewed 2026-10-25)