Source: Help Net Security
Author: Anamarija Pogorelec
URL: https://www.helpnetsecurity.com/2026/05/04/openai-chatgpt-advanced-account-security/
ONE SENTENCE SUMMARY:
OpenAI’s Advanced Account Security makes ChatGPT/Codex logins phishing-resistant via passkeys/security keys, tighter sessions, no support recovery, and training exclusion.
MAIN POINTS:
- OpenAI launched an opt-in Advanced Account Security setting for ChatGPT and Codex accounts.
- Enabling it disables password-based sign-in, requiring passkeys or physical security keys.
- Removing passwords reduces susceptibility to phishing and credential-stuffing attacks.
- Email and SMS recovery are eliminated to prevent takeover via compromised inboxes or phone numbers.
- Account recovery relies only on user-held backup passkeys, security keys, and recovery keys.
- OpenAI Support cannot restore access after enrollment, shifting recovery responsibility to users.
- Shorter sign-in sessions limit exposure from stolen devices or hijacked active sessions.
- One enrollment applies across both ChatGPT and Codex under the shared login.
- Conversations from enrolled accounts are excluded from model training automatically.
- Trusted Access for Cyber individuals must enable it by June 1, 2026, or use phishing-resistant SSO attestation.
TAKEAWAYS:
- Prioritize multiple backup authentication factors before enabling to avoid permanent lockout.
- Eliminating SMS/email recovery closes common account takeover routes tied to SIM-swaps and inbox compromise.
- FIDO2/WebAuthn-based methods align ChatGPT security with major platforms’ phishing-resistant standards.
- Hardware key bundles (e.g., dual YubiKeys) support primary-plus-backup operational resilience.
- Security-sensitive users gain default assurance their chats won’t be used for training without manual settings.