OpenAI hardens ChatGPT account security and partners with Yubico

On April 30, 2026, OpenAI launched a new set of optional protections for ChatGPT called Advanced Account Security. The company is betting on stricter authentication and, alongside it, is starting a partnership with Yubico to make it easier for users to switch to hardware security keys.

How the protection works

Advanced Account Security is a separate mode in ChatGPT's web security settings. It is aimed primarily at users at elevated risk of digital attacks, but anyone can turn it on. Once activated, the protection covers not only ChatGPT but also Codex, if the services are tied to the same login.

The logic is simple: an account holding work chats, code, notes and connected tools has become too valuable to rely on a password and standard account recovery alone.

• Sign-in only via passkeys or physical security keys
• Password sign-in disabled
• Recovery via email and SMS disabled
• Shorter user sessions
• Sign-in notifications and a view of active devices

The mode has a hard flip side. If a user loses their backup passkeys, hardware keys and recovery key, OpenAI support will not be able to restore access to the account. The company warns about this up front: extra protection also means extra responsibility for storing your keys.

At the same time, OpenAI automatically excludes conversations from such accounts from model training, which matters especially for people who handle sensitive personal or professional information.

The Yubico partnership

Alongside the new mode, OpenAI has arranged a dedicated key bundle from Yubico for ChatGPT users. It includes two models: the YubiKey C Nano for permanent use in a laptop, and the YubiKey C NFC as a backup for laptops and mobile devices. OpenAI mentions a discounted price for the bundle in the security settings, but the approach is not locked to the branded pairing: other FIDO-compatible keys and software passkeys will also work.

The point of the move is that a hardware key makes phishing considerably harder. Even if an attacker obtains a password or intercepts a one-time code, that is no longer enough to sign in. This matters especially for ChatGPT, because accounts gradually accumulate long context: personal questions, work documents, drafts, code, research notes and data from connected services. The deeper AI gets embedded in daily work, the more dangerous the compromise of a single account becomes.

Who it is for

OpenAI explicitly names several groups for whom the mode may be particularly useful: journalists, researchers, elected officials, political activists, and users who simply want maximum protection. The company also ties the launch to a broader cybersecurity agenda and to its Trusted Access for Cyber program. For individual participants in that program, enabling Advanced Account Security becomes mandatory from June 1, 2026; for organizations, the alternative may be to confirm phishing-resistant authentication within their own SSO.

The announcement shows OpenAI increasingly treating a ChatGPT account not as an ordinary consumer login but as an access point to sensitive data and workflows. That probably makes the change relevant to enterprise users too, although in this announcement the company focuses mainly on people in high-risk groups. In other words, ChatGPT is gradually shifting from a "convenient chat" to a "work environment that must be protected like email or a corporate messenger."

What it means

OpenAI is starting to move the security of AI services from the category of secondary settings into the category of core infrastructure. If ChatGPT stores more and more work and personal context, then hardware keys, passkeys and abandoning weak recovery methods become not an exotic option but the new standard for users who have something to lose.