Is it safe to let an AI agent work in my accounts?

• ›1. The agent has its own seat on the account, not your password.
• ›2. It asks you before it pays, sends or deletes.
• ›3. Every step it takes is written to a log you can read later.
• ›4. One switch ends its access at once.

Many sites tell owners not to share their login, and offer a separate seat instead: a staff account, user permissions or a delegate. Give the agent that seat with only the access the task needs. A seat that pulls reports doesn't need to issue refunds.

runnerID keeps the seat's login in the identity's own vault, not yours. Documented seats on common sites are in /guides/ai-agent-own-seat-not-your-password.

In each identity's site rules you list the sites it may use and the actions that need you. Before one of those actions the agent calls request_approval; runnerID emails you a link to approve or deny, or you answer in the owner console. The agent goes on only if you approve.

Agent payment cards are coming to runnerID. They are not part of it today.

Every action the identity takes goes into an append-only log. You read it in the owner console, download it as CSV or JSON, or let an agent read it with list_events. Entries record names and ids, not passwords, setup keys, API keys or email bodies.

Revoke shuts it all off at once. The agent can no longer use its logins, codes, inbox or saved sessions. It also deletes saved sessions and expires approvals still waiting. Remove the seat on the site too, the way you would remove an employee's account.

No. When runnerID can reach the browser, it types the password straight into the page, so it never enters the model, its tool output or its logs. When the browser runs on your own laptop, the helper uses its local route: the password passes through your own code once to be typed, and still never reaches the model.

Tool results never include a password or seed. Only get_email_code and get_authenticator_code return a code, and each release is logged.

A password or authenticator setup key is encrypted with AES-256-GCM under a key for that identity alone. A secret saved for a site is typed only into that site or a trusted subdomain, and the page address is read again right before typing.

• ›If runnerID can reach the browser (a hosted browser or one on your own server): Agents that drive a browser runnerID can reach, such as a hosted browser (Browserbase, Steel) or one on your own server, get the strongest mode: runnerID types the password itself.
• ›If the browser is on your own laptop: When the browser runs on your own laptop, the helper uses its local route: the password passes through your own code once to be typed, and still never reaches the model.
• ›If a hosted agent's browser is out of runnerID's reach: Hosted agents that connect over MCP get authenticator and emailed codes returned to them, and approvals and the log work the same. Typing a password into the page needs the runnerID helper next to the browser (Stagehand, Playwright or Browser Use), on a laptop or in a cloud container.

Your data is yours. We never use your content to train AI models: not your records, documents, emails, passwords or codes, and not what your agents read or type on the sites they visit. We do learn from how tasks get done, such as the steps a site's sign-in takes or where it asks for a code, with your content and personal details removed, so agents get better at the work. You can turn this off any time in your settings, and we never sell it or share it for anyone else to train on.

• ›Bank and brokerage accounts. runnerID is not for them.
• ›Sites whose terms forbid automated access. See /guides/do-websites-block-ai-agents.
• ›Accounts where you can't give the agent a narrow seat and can't approve its risky steps.

With OAuth, Anthropic says Claude can work in the app on your behalf "without Claude ever seeing your actual password." [1]

"1Password shows you exactly which item Claude is requesting, so you can approve, choose a different login to use, or deny the request." [2]

OpenAI says the username and password typed into its secure sign-in form are not visible to the model, and that ChatGPT asks for confirmation in chat before actions such as a booking or a payment [3].

Staff, delegate and service provider seats.

Site rules, approval by email link, the log and revoke.

Placeholders, saved sessions, vault autofill and agent identity.

Read the log after a run.

Why sites say no, and what to do instead.

• ›1. Claude Help Center, custom connectors: https://support.claude.com/en/articles/11175166
• ›2. 1Password Support, 1Password for Claude: https://support.1password.com/1password-claude/
• ›3. OpenAI Help Center, Using cloud browser in ChatGPT: https://help.openai.com/en/articles/20001280-using-cloud-browser-in-chatgpt
• ›4. runnerID API docs: https://api.runnerid.torchrunner.ai/llms.txt

Claude is a trademark of Anthropic. 1Password is a trademark of AgileBits. ChatGPT is a trademark of OpenAI. Browserbase, Steel, Stagehand, Playwright and Browser Use belong to their owners. runnerID and Torchrunner are independent of, and not affiliated with, endorsed by or sponsored by any of them.