OpenAI Introduces Advanced Account Security for ChatGPT and Codex Users
Key Points
- OpenAI launches Advanced Account Security for ChatGPT and Codex accounts.
- Passwords are replaced by two physical security keys or passkeys.
- Email and SMS recovery methods are removed; recovery uses keys only.
- Support staff cannot assist with account recovery once the tier is enabled.
- Shorter sign‑in windows and real‑time login alerts improve monitoring.
- Yubico offers discounted YubiKey bundles for users adopting the feature.
- Trusted Access for Cyber members must enable the tier by June 1 or provide an alternative attestation.
OpenAI announced Thursday that it will roll out an optional Advanced Account Security tier for ChatGPT and Codex accounts. The new feature replaces passwords with physical security keys or passkeys, eliminates email and SMS recovery, and forces tighter sign‑in windows. Aimed at high‑risk users such as journalists, elected officials and researchers, the measure also blocks support staff from accessing recovery options, limiting attackers’ social‑engineering avenues. OpenAI partnered with Yubico to offer discounted YubiKey bundles and will require members of its Trusted Access for Cyber program to enable the tier by June 1.
OpenAI unveiled an optional security tier on Thursday that adds a robust layer of protection for ChatGPT and Codex accounts deemed high‑risk. Dubbed Advanced Account Security, the feature forces users to abandon traditional passwords in favor of two physical security keys or passkeys, dramatically reducing the likelihood of phishing‑based takeovers.
The move mirrors Google’s long‑standing Advanced Protection program and comes as AI services expand into more personal and mission‑critical workflows. "People are turning to AI for deeply personal questions and increasingly high‑stakes work," the company wrote in a blog post. "For some, like journalists, elected officials, political dissidents, researchers, and those especially security‑conscious, the stakes are even higher."
Key features of Advanced Account Security
When enabled, the new tier removes password‑based login entirely. Users must register two hardware security keys—such as YubiKey devices—or compatible passkeys. Email and SMS recovery routes disappear; instead, account recovery relies on recovery keys, backup passkeys, or additional physical keys. OpenAI also shortened session lifetimes, prompting users to re‑authenticate more frequently.
Alert notifications appear on the dashboard whenever a new device signs in, giving account owners a clear view of active sessions. The feature automatically opts users out of having their conversations used for model training, a privacy safeguard that is enabled by default for those on the advanced tier.
Support staff lose the ability to intervene in account recovery, a deliberate design choice meant to prevent attackers from exploiting support channels through social engineering. "When a user turns on Advanced Account Security, they can no longer seek help from OpenAI’s support team for account recovery," the blog explained, underscoring the zero‑trust approach.
OpenAI has teamed with Yubico to provide lower‑cost YubiKey bundles for users who adopt the new security level. The partnership aims to lower the barrier for individuals and organizations that need phishing‑resistant authentication without a hefty price tag.
Members of OpenAI’s Trusted Access for Cyber program—researchers, cybersecurity professionals and other vetted participants—must enable Advanced Account Security by June 1, or submit an alternative attestation proving they use enterprise single sign‑on with phishing‑resistant authentication.
The rollout is part of a broader cybersecurity strategy announced earlier this month, reflecting growing concerns about credential theft as AI tools become embedded in news platforms, corporate workflows, and public services. By tightening access controls, OpenAI hopes to protect the sensitive personal and professional context that can accumulate in a single ChatGPT account.
While the feature is optional for most users, OpenAI’s messaging suggests it will become the default for users with elevated risk profiles. The company says the new tier is a step toward a more secure AI ecosystem, where the convenience of conversational agents does not come at the expense of user safety.