How to Handle 2FA in an AI Agent Without Breaking Security

Two-factor authentication is working as intended when it stops your agent. The goal is not to defeat it. The goal is to let the right human answer it, in the agent's session, quickly, and then not be asked again for weeks.

The two bad answers

Turning 2FA off for the agent account removes the protection from an account that now acts autonomously across many sites, which is the account that needs it most. Putting the TOTP seed in the agent's configuration means the second factor now lives next to the first one, so it is no longer a second factor, and it sits in a prompt that ends up in logs.

The answer that keeps 2FA intact

The agent recognises the second-factor prompt and stops. A person is notified with a link to the agent's live browser. They approve the push on their own phone, or type the code into the field they can see, in the agent's session. The site marks the browser as trusted, usually for thirty days, and the agent carries on. The human spent fifteen seconds and the secret never left their device.

Make it happen less

Most of the pain is repeated prompts, and most repeated prompts come from throwing the browser profile away. Persist the profile per agent so the trusted-device cookie survives. One human approval a month per site is a cost any team accepts; one per run is not.

if page_asks_for_second_factor(page):
    # A person approves on their own phone or types the code into this browser.
    fix = oo.request_fix(url=page.url, task="approve the sign-in second factor")
    wait_for(fix)
    # The profile now holds the trusted-device cookie; this prompt should not return for weeks.

A recorded fix here is deliberately thin. The procedure that gets learned is where the prompt appears and what to press afterwards. The code itself is never captured, because a fix session is exactly where codes get typed.

Questions people ask