Using AI Agents to Help Do Your Taxes: What to Delegate and What Not To

What we mean by an AI agent

Unlike a chatbot that only answers, an agent can operate a browser or computer: open sites, click, fill forms and download files. Examples include ChatGPT agent, Claude computer use and Claude in Chrome, and Grok Bot. OpenAI says that when you sign its agent into websites or enable apps, it can access sensitive data and perform actions on your behalf. [1]

The core rule: an agent can do the legwork, but you are the taxpayer. The IRS says you are responsible for all of the information on your return, even if someone else prepares it. [2]

Good jobs to delegate

Building a document inventory: list every W-2, 1099, 1098 and statement you expect, based on last year's return (with identifiers removed).
Organizing files you already downloaded: renaming, sorting into folders, and flagging what is missing.
Reading public pages for you, such as IRS form instructions, and summarizing what applies.
Cross-checking: comparing totals in your software's summary against your source documents, line by line.
Drafting questions for a tax pro or for your software's support.

Jobs to keep for yourself

Logging in. OpenAI recommends you avoid typing passwords or private info into messages and use takeover mode for sensitive inputs; it says screenshots are not captured while you control the browser. [1]
Entering your SSN, bank and routing numbers, and your IRS IP PIN.
Signing. When you e-file with software, your Self-select PIN serves as your electronic signature. [3] Don't hand that step to an agent.
Clicking final submit, payment or refund-deposit screens.

The big risk: prompt injection

Prompt injection means hidden instructions in a webpage, email or document try to steer the agent. OpenAI gives the example of a malicious prompt hidden in a webpage tricking an agent into sharing private data or taking a harmful action on a site you are logged into. [4] Anthropic warns that Claude may sometimes follow instructions found in content even when they conflict with yours, and says to isolate it from sensitive data and actions. [5]

Both companies describe safeguards (confirmations, monitoring, classifiers) and both say the risk is not zero. [1] [6]

Safety setup before you start

Use a separate browser profile, and stick to trusted sites for sensitive work. Anthropic recommends this kind of caution for Claude in Chrome. [6]
Enable only the apps and connectors the task needs, and log out or clear agent browser data afterward. [1]
Give narrow instructions. OpenAI warns broad requests like "review my emails and take whatever action is needed" make it easier for hidden content to mislead the agent. [7]
Read every confirmation prompt before approving. [7]
Stop the task immediately if the agent does something you did not ask for. [1]

A safe agent workflow, step by step

1. Gather: download your forms yourself from employers, banks and brokers. Ask the agent to inventory the folder and list what is missing compared with last year.
2. Organize: have it rename and sort files and build a one-page summary of income by source, using totals only.
3. Prepare: you enter data in your tax software. Optionally let the agent read IRS instructions and explain screens.
4. Check: ask the agent to compare your software's summary with your source totals and list every mismatch.
5. Review and sign: you go through the full return, fix issues, and sign with your own PIN. Run the IRS common-errors checklist first. [2]

A prompt to start with

Prompt

You are helping me organize (not file) my 2025 US tax documents. In the folder I've opened, list each document, what type it is (W-2, 1099-INT, etc.) and the issuer. Compare against this list of what I received last year: [list]. Report anything missing. Do not open any website, log in anywhere, or type any personal numbers.

Related: read the AI tax privacy checklist and the step-by-step chatbot guide.

Sources

OpenAI Help Center: ChatGPT agent Verified Oct 16, 2026
IRS Topic no. 303: Checklist of common errors Verified Oct 16, 2026
IRS FAQ: Signing the return Verified Oct 16, 2026
OpenAI: Introducing ChatGPT agent Verified Oct 16, 2026
Anthropic docs: Computer use tool Verified Oct 16, 2026
Claude Help Center: Use Claude in Chrome safely Verified Oct 16, 2026
OpenAI: Understanding prompt injections Verified Oct 16, 2026

FAQ

Can an AI agent file my taxes for me?

It may be able to click through software, but the e-file signature (your Self-select PIN) is yours, and the IRS says you are responsible for everything on your return. Do the final review and signing yourself.

Should I give an agent my tax software password?

We recommend not. OpenAI advises using takeover mode for sensitive inputs, and Anthropic warns that using computer use in apps that require login raises prompt-injection risk.

What is prompt injection?

Hidden instructions in a webpage, email or document that try to make the agent do something you did not ask for, such as sharing your data. Both OpenAI and Anthropic say their defenses reduce but do not eliminate this risk.