OpenAI has introduced a new security feature for ChatGPT that removes passwords and adds stronger protections for high risk users.
Quick Summary – TLDR:
- OpenAI launches Advanced Account Security for ChatGPT and Codex.
- Feature removes password logins and uses passkeys and security keys.
- Designed for users at higher risk of cyber attacks.
- Comes with stricter recovery rules and no support based recovery option.
What Happened?
OpenAI has rolled out an optional Advanced Account Security feature that significantly strengthens account protection for ChatGPT and Codex users. The new mode replaces traditional passwords with more secure login methods like passkeys and hardware security keys. It is now available through the Security settings on the web version of ChatGPT.
Now available for ChatGPT accounts: Advanced Account Security, a new opt-in setting for people at higher risk of digital attacks, with stronger protections including phishing-resistant sign-in and more secure account recovery.https://t.co/KhBGENuXzT
— OpenAI (@OpenAI) April 30, 2026
Why OpenAI Is Strengthening Account Security?
As AI tools become deeply embedded in personal and professional workflows, user accounts are holding more sensitive data than ever before. OpenAI says many users rely on ChatGPT for confidential work, research, and personal queries, making them attractive targets for cyber attacks.
The company highlighted that certain groups face even greater risks, including:
- Journalists and researchers handling sensitive information.
- Government officials and political figures.
- Human rights activists and dissidents.
- Users who are generally security conscious.
OpenAI stated, “People are turning to AI for deeply personal questions and increasingly high-stakes work,” emphasizing the growing importance of strong account protection.
Passwords Are Gone in This New Mode
One of the most notable changes is the complete removal of password based login systems. Instead, users must rely on:
- Hardware security keys such as USB based devices.
- Software passkeys stored on personal devices.
These methods are considered phishing resistant, meaning attackers cannot easily steal access through fake emails or login pages.
The system also blocks common attack methods like:
- Password guessing attacks.
- Phishing attempts.
- SIM swap attacks.
Stricter Account Recovery with Trade Offs
While the new system improves security, it also introduces serious limitations for account recovery. Users can no longer recover accounts using:
- Email verification.
- SMS-based codes.
Instead, recovery depends entirely on:
- Backup security keys or passkeys.
- Recovery keys issued during setup.
OpenAI has made it clear that its support team cannot help recover accounts if users lose access to these methods. This decision is meant to prevent attackers from exploiting support channels through social engineering.
To reduce risk, users must set up:
- At least two security methods, such as two hardware keys or a mix of key and passkey.
- A secure backup recovery key stored safely.
Additional Security Enhancements
Beyond login protection, the feature introduces several other safeguards:
- Shorter login sessions to limit exposure if a device is compromised.
- Real time alerts for new account logins.
- A dashboard to monitor and manage active sessions across devices.
Another important change is related to privacy. Conversations from accounts with Advanced Account Security enabled are automatically excluded from AI model training, removing the need for manual opt out.
Partnership with Yubico for Security Keys
To make hardware security more accessible, OpenAI has partnered with Yubico, a well known security company. Users can purchase a discounted bundle that includes:
- YubiKey C Nano for everyday use.
- YubiKey C NFC as a backup option.
The bundle is priced at 68 dollars and is available through the security settings page. However, users are free to use any compatible FIDO certified security key.
Inspired by Industry Standards
The new feature follows a broader trend in the tech industry. Similar programs, like Google’s Advanced Protection system, have been around for years and were designed after major phishing attacks targeted high profile accounts.
OpenAI clarified that this launch is not a response to any specific breach, but rather a proactive step to prepare for future threats as AI adoption continues to grow rapidly.
Requirement for Cybersecurity Program Members
OpenAI also announced that members of its Trusted Access for Cyber program will be required to enable Advanced Account Security starting June 1, 2026. Organizations can alternatively confirm they use phishing resistant authentication through enterprise login systems.
SQ Magazine Takeaway
I think this move was inevitable. As AI tools like ChatGPT become central to work and personal life, accounts are no longer just accounts, they are data vaults. Removing passwords might feel extreme, but honestly, it is one of the smartest decisions OpenAI could make right now.
The trade off is real though. Losing access means you are on your own. That is a big responsibility, and not everyone will be comfortable with it. Still, for people handling sensitive data, this feature feels less like an option and more like a necessity.
