Say goodbye to passwords: ChatGPT's Advanced Account Security is here!

Hey there, it's Shii-chan! Today I've got news for anyone who wants to lock their account down for real.

OpenAI News openai.com

What was announced?

OpenAI News introduced Advanced Account Security, a new opt-in setting for ChatGPT accounts. It bundles together stronger protections against account takeover, and it's built both for people at higher risk of digital attacks and for anyone who wants the strongest protection available. Once you turn it on, it protects your Codex account too.

Why it matters

We're all bringing deeply personal questions and high-stakes work to AI now. Over time a ChatGPT account can hold sensitive personal and professional context, and it sits at the center of connected tools and workflows.

For people like journalists, elected officials, political dissidents, researchers, and the especially security-conscious, the stakes are even higher, so being able to switch on the strongest protection in one place is a big deal. It's part of OpenAI's broader cybersecurity action plan.

What changes

Until now, the baseline was roughly a password plus 2FA. With Advanced Account Security on, the foundation itself changes: password login is disabled, and you sign in only with phishing-resistant keys. Your conversations are also automatically excluded from model training, so both security and privacy get a big lift.

The trade-off: stronger protection means account recovery becomes your responsibility. More on that below.

Dive Deep

You opt in from the Security section of your ChatGPT account, and it applies to both ChatGPT and Codex accounts reached through that login. There are four main pieces:

• Stronger sign-in: disables password-based login and requires passkeys or physical security keys, making phishing-resistant sign-in the default.
• More secure account recovery: disables email and SMS recovery and requires backup passkeys, security keys, and recovery keys, so a compromised email or phone number can't be used to break in.
• Shorter sessions and clearer management: sessions are shortened to reduce exposure if a device is compromised, you get login alerts, and you can review and manage active sessions across devices.
• Automatic training exclusion: conversations from enrolled accounts are automatically kept out of model training.

One important caveat, since recovery is limited to strong methods:

OpenAI Support will not be able to assist with account recovery for users enrolled in Advanced Account Security.

So keep your keys and recovery keys safe!

For hardware keys, OpenAI partnered with Yubico for preferred pricing on a YubiKey bundle: the YubiKey C Nano to stay in your laptop for everyday login, and the YubiKey C NFC for backup and use across laptops and mobile. You can also use any FIDO-compliant security key or software-based passkeys.

And individual members of Trusted Access for Cyber using the most cyber-capable models will be required to enable Advanced Account Security beginning June 1, 2026. Organizations can instead attest that they use phishing-resistant authentication in their single sign-on workflow.

Wrap-up

• ChatGPT's new opt-in setting Advanced Account Security turns on a bundle of account-takeover protections in one place
• Password login is disabled in favor of passkeys and physical security keys for phishing resistance
• Email/SMS recovery is disabled in favor of keys and recovery keys, and Support can't help you recover, so guard your keys
• Sessions get shorter with login alerts, and conversations are automatically excluded from training
• OpenAI partnered with Yubico for a discounted YubiKey bundle, and Trusted Access for Cyber individuals must enable it from June 1, 2026

If you're a journalist or activist who has to stay protected, or a security fan ready to graduate from passwords to key-based sign-in, this one's for you!