Summary: On April 30, 2026, OpenAI introduced Advanced Account Security as an opt-in ChatGPT setting that replaces password login with passkeys or security keys and narrows recovery options. Individual members of Trusted Access for Cyber must enable it on June 1, 2026, while organizations may attest to phishing-resistant single sign-on instead. The tradeoff is that OpenAI support cannot recover an enrolled account if every backup credential is lost.
What’s New: An Optional Security Tier for ChatGPT
On April 30, 2026, OpenAI rolled out Advanced Account Security, an opt-in setting for ChatGPT accounts built for people who face an elevated risk of digital attacks: journalists, elected officials, political dissidents, researchers, and users who take security seriously. The feature gathers several hardened protections under one roof, and once it’s on, Codex accounts reached through the same login are covered too.
The setting belongs to OpenAI’s wider cybersecurity action plan, an effort to put protective technologies in more hands. OpenAI is upfront that the added protection carries added responsibility for account recovery—a trade-off you should understand before switching it on.
Under the Hood: The Four Controls That Take Effect
Opt in from the Security section of your ChatGPT account, and four categories of controls go to work:
- Hardened sign-in: Passkeys or physical security keys become the only way in, and password-based login is switched off—phishing-resistant sign-in is simply the default from then on.
- Locked-down account recovery: Email and SMS recovery, both common attack vectors once your email or phone is compromised, are turned off. Recovery instead runs through backup passkeys, security keys, or recovery keys—and because the options are deliberately narrow, OpenAI Support cannot assist with account recovery for enrolled users.
- Shorter sessions, clearer session management: Sign-in sessions expire sooner, shrinking the exposure window when a device or session is compromised. Login alerts tell you when a sign-in happens, and you can review and manage active sessions across your devices.
- Automatic training exclusion: Conversations on your account stay out of OpenAI’s model training—no manual opt-out needed each time.
The four measures are built to reinforce one another: taking password login off the table cuts off phishing as a way in, while the stricter recovery rules stop an attacker who holds a compromised email address or phone number from simply resetting their way into the account.
Hands-On Setup: Passkeys and Security Keys from Day One
You switch Advanced Account Security on from the Security settings of your ChatGPT account. Before you can, at least one passkey or security key must be registered, since password login disappears the moment the feature is enabled.
A setup sequence that works well for developers and power users:
- Register a passkey on the device you use most (laptop or phone). It can be a software passkey (for example, iCloud Keychain, Google Password Manager, or Windows Hello) or a hardware security key.
- Add a backup passkey or recovery key on separate hardware. This step is non-negotiable: lose your only passkey and you’re locked out for good—OpenAI Support won’t be able to help.
- Turn on Advanced Account Security in the Security settings.
- Walk the recovery path by signing out and signing back in with your backup method.
On the hardware side, OpenAI has teamed up with Yubico for preferred pricing on a two-key YubiKey bundle: the YubiKey C Nano, made to stay plugged into your laptop, and the YubiKey C NFC, which serves as a backup and moves between devices. The bundle is open to every eligible user in their security settings—you don’t have to be enrolled in Advanced Account Security. Any FIDO-compliant security key or software passkey works just as well.
Who It’s For: High-Risk Users and the Trusted Access for Cyber Mandate
OpenAI frames the feature around individuals confronting elevated digital threats. If you report on sensitive subjects as a journalist, campaign as an activist, handle confidential data as a researcher, or simply want maximum protection for a ChatGPT account that holds years of personal and professional context, enabling it is worthwhile.
A hard requirement is on the calendar: starting June 1, 2026, individual members of Trusted Access for Cyber—the program that gives verified defenders access to OpenAI’s most capable and permissive models—must enable Advanced Account Security. Organizations with trusted access can meet the bar differently, by attesting that their single sign-on workflow already includes phishing-resistant authentication. The signal is clear: OpenAI is turning stronger security from a suggestion into an obligation for high-risk roles.
For product builders, treat it as a prompt: once AI tools sit at the center of sensitive work, account security can’t be bolted on afterward. If you’re building on OpenAI’s platform, examine how your own authentication and recovery flows handle phishing resistance and session management.
Costs and Constraints: Recovery Now Rests on Your Shoulders
Recovery is where the trade-off bites hardest. With email and SMS recovery gone, backup passkeys, security keys, and recovery keys have to be stored securely under your control. Lose every one of them and the account is gone for good—OpenAI Support explicitly cannot step in. The hard line exists by design, to starve social engineering attacks of an opening, but it stacks a heavy burden on the user.
Other constraints worth noting:
- Not a fit for every account: Outside high-risk situations, juggling hardware keys and multiple passkeys can cost more convenience than it buys in safety.
- Session management: Expiring sooner means re-authenticating more often—irritating on shared or multiple devices.
- Training exclusion is automatic: A privacy win, though it also means your conversations will no longer feed model improvements—worth weighing if you valued that.
- Enterprise rollout is future: OpenAI expects to extend the work to additional audiences, enterprise environments among them, but no timeline has been given.
The Bottom Line for Builders and Users
For high-risk users, Advanced Account Security is a strong, carefully designed option—but it rewards preparation rather than a one-time flip of a switch. Sort out your recovery plan first: register at least two passkeys or security keys, keep recovery keys somewhere safe, and rehearse the flow. The lesson for product builders is just as plain: when AI tools handle sensitive data, protections such as phishing-resistant login and strict recovery belong in the product’s core design, not in an optional add-on. OpenAI is modeling that stance, and the June 1 requirement for Trusted Access for Cyber makes the direction obvious—stronger security is becoming the baseline for high-stakes use cases.