OpenAI launches advanced account security: Passkey and physical security key escort ChatGPT and Codex users

Core conclusion

OpenAI officially launched "Advanced Account Security" on May 1, 2026, which is open to users with high security risks. Once enabled, users can log in to ChatGPT and Codex accounts through Passkey or physical security keys, while receiving real-time alerts for new logins and automatically exiting AI model training. This is OpenAI’s most powerful update to date in the area of ​​account security, and is a direct response to growing concerns about account hijacking among users of AI tools.

Key Points

• Time of incident: 2026-05-01 -Affected objects: All ChatGPT and Codex users, especially content creators who frequently use AI Agent
• Core changes: Passkey login + physical security key + new login alert + automatic exit from training

Background and trigger events

AI account security is becoming a seriously underestimated risk point. As AI tools such as ChatGPT, Claude Code, and Codex are deeply embedded in the daily work of content creators and software developers, the consequences of account hijacking have become increasingly serious—not only involving API key leaks and fee theft, but also more subtle threats such as prompt word history exposure and automated work order data leakage.

The advanced account security features launched by OpenAI were confirmed by a report by The Verge reporter Emma Roth on May 1, 2026. Users can turn on "Advanced Account Security Settings" in the OpenAI account settings. Afterwards, they can only log in by binding a passkey or a physical security key (such as YubiKey). The traditional password + SMS verification code method is completely replaced.

Key Impact (by Dimension)

Adaptation suggestions

• If you use YubiKey or Google Titan, you can now bind it directly in the OpenAI account settings, instead of relying on third-party 2FA tools before
• For team collaboration scenarios, it is recommended to enable this function for each core member to avoid the risk of leakage caused by shared passwords
• API calls in automated workflows are not affected (API uses API Key authentication), but it is recommended to check the API Key permission scope simultaneously
• When enabled, ChatGPT's web session will require security key verification every time a new device logs in

Task List

• Log in to your OpenAI account, enter security settings, and turn on Advanced Account Security
• Bind 1 Passkey (supported by mobile phone/computer) + 1 physical security key (spare)
• Check whether Codex and ChatGPT accounts are enabled simultaneously
• Clean up API Keys that are no longer used

Example: How to enable advanced security in OpenAI

 ChatGPT
1. → Settings
2. Security & Data
3. Advanced Account Security → Enable
4. Passkey (Face ID / Touch ID / Windows Hello)
5. YubiKey
6. 。。

• The Verge: OpenAI adds stronger security features for users at high-risk of hacks
• OpenAI : Introducing Advanced Account Security

ChatGPT ， OpenAI、ChatGPT、Claude、Codex、n8n ， API Key Web 。Hermes Agent It is also recommended to enable strong authentication.

Internal link guidance

• Want to systematically build a secure content automation workflow? See: How to build an AI content automated distribution system with n8n + ChatGPT: a complete 30-minute tutorial
• Real case: Someone uses ChatGPT + n8n to automate content distribution, and the monthly income is $5,200: I use ChatGPT advertising platform + n8n to automate content distribution and earn a real review of $5,200 per month