OpenAI drops passwords for passkeys with new high-risk security mode

If someone hacks your personal email, you get spam. If someone hacks your ChatGPT account, they get a raw transcript of your business plans, draft research, and late-night thoughts.

OpenAI rolled out Advanced Account Security, an opt-in set of heightened protections for ChatGPT and Codex designed specifically for journalists, elected officials, researchers, and anyone dealing with high-risk data.

Cutting the cord on passwords and support

Once you toggle the feature on, standard passwords are gone entirely.

Logins are restricted to phishing-resistant passkeys or physical FIDO security keys. Email and SMS-based account recovery are also completely disabled to prevent attackers from using compromised inboxes or SIM-swaps to reset your access.

That creates a massive catch: if you lose your backup passkeys and recovery keys, OpenAI customer support cannot help you get back in. Your account and conversation history are essentially gone for good.

The update also automatically shortens active sessions, sends immediate login alerts across devices, and auto-excludes all account conversations from model training data without needing a manual toggle.

To grease the wheels, OpenAI partnered with Yubico to offer discounted hardware bundles featuring the unobtrusive YubiKey C Nano for laptops and the YubiKey C NFC for mobile backup.

While optional for the general public, members of OpenAI's Trusted Access for Cyber program who handle frontier defensive models must turn it on by June 1, 2026.

Why it matters

We think this is a long-overdue reality check for how people actually use AI.

ChatGPT has quietly evolved from a fun toy into mission-critical infrastructure where professionals dump unreleased code, legal drafts, and sensitive strategic questions. As cybersecurity researchers warn that LLM accounts are prime targets for extortion, having military-grade locks is no longer overkill for anyone working with valuable IP.

Strategically, OpenAI is signaling to enterprise and government clients that it takes operational security as seriously as traditional cloud giants, especially after Anthropic made waves with its Mythos cybersecurity model.

The smartest part of this rollout is OpenAI's refusal to leave a customer service backdoor open. By completely eliminating SMS resets and locking out their own support reps from overrides, they chose real cryptographic safety over convenience. It means regular users need to be extremely careful with their backup keys, but for high-risk targets, it makes account takeovers practically impossible.