OpenAI's new feature authorizes its automation agents to read and enter authentication codes sent via email. A tool designed to reduce friction at login that, in vulnerable markets such as Mexico and Latin America, sets off serious cybersecurity alarms.
In the race to eliminate any trace of friction in human-computer interaction, OpenAI has taken a bold step within the development of its autonomous Dots agents. The company announced that these digital tools can now autonomously access the user's email to read and enter one-time verification (OTP) codes during the login process on various platforms.
While automating authentication promises to streamline complex workflows, the move introduces an urgent debate about delegating critical credentials to systems operating in the cloud.
1. Credential automation: one-time or permanent access
OpenAI's technical implementation allows users to define the scope of control granted to Dots agents when faced with a verification window:
- Allow Once: Authorizes the agent to access the inbox to extract a specific code during an active session.
- Always Allow: Continuously delegates the reading of authentication emails so that the agent logs in transparently in the background.
While this capability solves one of the biggest bottlenecks in automating multitasking tasks, it involves relinquishing custody of one of the pillars of contemporary digital security: identity validation.
2. The risk factor in Mexico and Latin America: Phishing and account compromise
In the IT context of Mexico and the Latam region – where phishing campaigns, credential hijacking and social engineering through email register alarming rates – this functionality adds a considerable attack vector.
If a user's email account or the environment where the agent operates is compromised, cybercriminals not only gain access to regular correspondence, but also have an automated gateway to all linked services. The lack of cybersecurity education around cloud permission management increases the likelihood that users will grant permanent access without measuring the repercussions in the event of a data breach.
3. Mitigation strategies: What's next for users and businesses?
When integrating OTP-readable agents, proactive digital governance and protection measures are imperative:
- Use of dedicated emails: Separate corporate and personal email accounts from those used exclusively for interaction and testing with AI agents in the cloud.
- Periodic review and revocation of permissions: Constantly audit which services and agents maintain active authorization to read the inbox.
- Requiring audits and access histories: Requiring AI vendors to provide detailed logs that show exactly when, how, and why an agent read a verification code.
Sources and credits: Text adapted and written by the Digitalia editorial team based on the official OpenAI Help documentation.
