ChatGPT advanced account security adds passkeys and hardware keys
OpenAI launches Advanced Account Security for ChatGPT and Codex, replacing passwords with passkeys or hardware keys and disabling email/SMS recovery.
The opt-in setting disables password sign-in plus email and SMS account recovery for ChatGPT and Codex accounts, allowing only passkeys, hardware security keys, and user-held recovery keys, with shortened sessions and automatic exclusion of enrolled accounts' conversations from model training. OpenAI partnered with Yubico to offer discounted bundles of the YubiKey C Nano and C NFC, while any FIDO2/WebAuthn-compliant key or software passkey is supported, mirroring standards adopted by Google, Microsoft, and GitHub. Individual members of Trusted Access for Cyber using the most permissive models must enable the setting from June 1, 2026, or their organizations can attest to phishing-resistant authentication in their single sign-on.
- After enrollment, OpenAI Support cannot assist with recovery, placing backup-credential responsibility on users.
- Recovery paths are limited to backup passkeys, security keys, and recovery keys, closing phone and inbox compromise routes.
- Follows the same FIDO2 and WebAuthn specifications used by Google, Microsoft, and GitHub.
- Yubico bundle pairs a permanently seated C Nano key with a C NFC key for backup and cross-device use.
From the original article
2 min read at helpnetsecurity.com
Journalists, elected officials, researchers, and political dissidents have spent years adapting their accounts to phishing-resistant authentication on consumer platforms. ChatGPT now joins that list. OpenAI has introduced Advanced Account Security, an opt-in setting that strips password-based sign-in from ChatGPT and Codex accounts and replaces it with passkeys or physical security keys.
By @helpnetsecurity · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.