OpenAI strengthens ChatGPT account security and launches partnership with Yubico

OpenAI on April 30, 2026 launched a new set of optional protection measures for ChatGPT called Advanced Account Security. The company is betting on stricter authentication while simultaneously launching a partnership with Yubico to make it easier for users to transition to hardware security keys.

How Advanced Account Security Works

Advanced Account Security is a separate mode in ChatGPT's security settings on the web. It is designed primarily for users at elevated risk of digital attacks, but anyone can enable it. Once activated, the protection extends not only to ChatGPT, but also to Codex if the services are linked to the same login. The logic here is simple: an account with work chats, code, notes, and connected tools becomes too valuable to rely only on a password and standard access recovery.

• Login only via passkeys or physical security keys
• Password login disabled
• Recovery via email and SMS disabled
• Shorter user sessions
• Login notifications and view of active devices

The mode has a strict downside. If a user loses backup passkeys, hardware keys, and the recovery key, OpenAI's support service cannot restore access to the account. The company warns about this directly in advance: additional protection also means additional responsibility for storing keys.

At the same time, OpenAI automatically excludes conversations from such accounts from model training, which is especially important for people working with sensitive personal or professional information.

Partnership with Yubico

Along with the launch of the mode, OpenAI made an agreement with Yubico for a special set of keys for ChatGPT users. These are two models: YubiKey C Nano for permanent use in a laptop and YubiKey C NFC as a backup option for laptops and mobile devices. OpenAI mentions a preferential price for this set in security settings, but the approach is not locked only to this branded bundle: other FIDO-compatible keys will work, as well as software passkeys.

The point of this step is that a hardware key significantly complicates phishing. Even if an attacker obtains a password or intercepts a one-time code, this is no longer sufficient for login. For ChatGPT this is especially relevant because accounts gradually accumulate a long context: personal questions, work documents, drafts, code, research notes, and data from connected services. The deeper AI becomes embedded in daily work, the more dangerous account compromise becomes.

Who This Is For

OpenAI directly names several groups for whom such a mode might be especially useful: journalists, researchers, elected officials, political activists, and users who simply want maximum protection. The company separately links the launch to a broader cybersecurity agenda and the Trusted Access for Cyber program. For individual participants in this program, enabling Advanced Account Security will be mandatory from June 1, 2026; for organizations, an alternative may be confirming phishing-resistant authentication within their own SSO.

From the announcement, it is clear that OpenAI increasingly views the ChatGPT account not as a typical consumer login, but as a point of access to sensitive data and workflows. This likely makes the innovation important for corporate users as well, although in the current message the company emphasizes primarily people from high-risk groups.

In other words, ChatGPT is gradually transitioning from the "convenient chat" model to the "work environment that needs to be protected like email or a corporate messenger" model.

What This Means

OpenAI is beginning to shift the security of AI services from the category of secondary settings to the category of basic infrastructure. If ChatGPT stores more and more work and personal context, then hardware keys, passkeys, and the abandonment of weak recovery methods become not exotic, but a new standard for users who have something to lose.