# OpenAI's new security tier shows AI accounts are becoming critical infrastructure identities Source: TechNewsList (https://technewslist.com) Canonical URL: https://technewslist.com/en/article/openai-advanced-account-security-identity-infrastructure-2026-05-02 Section: AI (https://technewslist.com/en/ai) Author: TechNewsList Language: en Published: 2026-05-02T05:20:23.748+00:00 Updated: 2026-05-02T05:20:23.909507+00:00 > OpenAI's April 30 launch of Advanced Account Security is a small product change with a larger implication: frontier AI accounts are no longer casual logins. They are becoming high-value operational identities that can expose code, business context, and security-sensitive workflows if they are taken over. ## TL;DR - On April 30, 2026, OpenAI introduced Advanced Account Security for ChatGPT and Codex accounts, adding phishing-resistant login and stricter recovery controls. - The feature disables password-based sign-in and email or SMS recovery, pushing users toward passkeys, hardware security keys, and recovery keys. - OpenAI will require the setting for individual Trusted Access for Cyber users beginning June 1, 2026, showing the company views some AI accounts as security-critical assets. - The bigger signal is strategic: AI accounts now hold enough personal, technical, and operational context that they need protections closer to high-risk enterprise identity systems than normal consumer logins. ## Key points - Category: AI. - Main topic: OpenAI is reframing AI account security as infrastructure security. - Advanced Account Security covers both ChatGPT and Codex under the same protected login. - The new mode reduces account recovery convenience in exchange for much stronger resistance to phishing and social engineering. - Mandatory adoption for cyber-access users suggests more capable frontier-model access will increasingly require stronger identity controls. - Watch next: whether similar protections become standard across other frontier AI platforms and enterprise AI tenants. # OpenAI's new security tier shows AI accounts are becoming critical infrastructure identities ## What happened On April 30, 2026, OpenAI launched Advanced Account Security, a new opt-in protection tier for ChatGPT accounts that also extends to Codex. The feature bundles several hardening measures into a single mode: password-based login is disabled, phishing-resistant sign-in methods such as passkeys and physical security keys become the default, sessions are shortened, login alerts become more visible, and recovery by e-mail or SMS is turned off in favor of stronger recovery methods. ![Editorial image from WIRED](https://media.wired.com/photos/69f3851f013dbae7ce7c178e/3:2/w_2560%2Cc_limit/security_chatgpt_GettyImages-2271059989.jpg) *WIRED visual context for this story.* OpenAI also tied the launch to its higher-risk user base. The company said individual members of Trusted Access for Cyber who use its more cyber-capable and more permissive models will be required to enable Advanced Account Security beginning June 1, 2026, unless their organization can attest that its single sign-on stack already uses phishing-resistant authentication. That requirement matters because it links frontier model access directly to identity assurance. In parallel, OpenAI partnered with Yubico to offer preferred pricing for security key bundles. That detail may look tactical, but it reinforces the main point: OpenAI is trying to move strong account protection from a niche habit into a practical default for people whose AI accounts now sit near valuable code, sensitive prompts, security workflows, and connected tools. ## Why it matters The interesting part is not that hardware keys are good. That has been true for years. The interesting part is that OpenAI is now treating some AI accounts as high-risk operational surfaces rather than ordinary SaaS logins. That is a meaningful shift in how frontier AI products are being positioned. A ChatGPT or Codex account can now contain research notes, debugging traces, API-related context, internal documents, planning conversations, and access paths into connected systems. If an attacker compromises that account, the prize is no longer just a chat history. It can be business context, software context, and in some cases a stepping stone into broader workflows. That is why the tradeoff OpenAI is making is revealing. Advanced Account Security deliberately makes recovery harder and support less able to help. In a normal consumer product, that kind of friction would be unattractive. In a high-risk identity system, it is often exactly the point. OpenAI is signaling that convenience-first recovery is becoming too dangerous for some categories of AI use. ## Technical details According to OpenAI, Advanced Account Security replaces password login with passkeys or physical security keys and removes e-mail and SMS as recovery channels. Recovery instead relies on stronger methods such as backup passkeys, recovery keys, and security keys. OpenAI Support cannot recover these accounts for enrolled users, which reduces the chance that an attacker can socially engineer support staff into bypassing the policy. ![Editorial image from WIRED](https://media.wired.com/photos/69f38b586da8922b4375291f/master/w_1600%2Cc_limit/security_Hero-image.jpg) *WIRED visual context for this story.* The feature also shortens active sessions, adds clearer session visibility, and automatically excludes conversations from model training for accounts using the protection tier. That last piece is notable because it connects account security with privacy posture. OpenAI is not only reducing takeover risk; it is also reducing exposure for especially sensitive work handled through those accounts. The requirement for Trusted Access for Cyber members adds another layer. OpenAI is effectively saying that if a user wants access to models with stronger cybersecurity capabilities, the surrounding identity controls need to rise as well. In other words, frontier model governance is starting to include not just who gets access, but how securely that access is held. ## Market / industry impact This will likely push the rest of the frontier model market in the same direction. If one major AI platform starts tying higher-capability access to phishing-resistant identity, other labs and enterprise AI vendors will face pressure to do something similar. That is especially true for products used in coding, red teaming, security analysis, or operations work. It also changes the identity discussion for enterprises adopting AI broadly. Many organizations still treat AI access as another app license. That framing is getting weaker. As AI tools become execution surfaces for code, knowledge work, and security operations, their accounts begin to resemble privileged endpoints. The security model around them has to change accordingly. There is also a product strategy implication. If users store more valuable context in AI products over time, account trust becomes part of the platform moat. A company that cannot credibly protect that context may find enterprise adoption harder, especially in regulated or security-sensitive environments. ## What to watch next Watch whether OpenAI expands this model into more enterprise-specific controls, especially for tenant-level enforcement, admin policy, and stronger visibility over risky sessions. The current release is a strong signal, but it still begins as an opt-in user setting outside the mandatory cyber-access use case. Also watch competitors. If Anthropic, Google, Microsoft, or other major AI providers start copying the same pattern, that will confirm the industry sees AI account takeover as a first-order risk rather than a secondary support issue. Most of all, watch how access to more capable models gets governed. In 2026, the frontier is not only about model capability. It is also about whether the identity layer around those models is strong enough for the work people are starting to trust them with. ## Sources - OpenAI: April 30, 2026 launch of Advanced Account Security for ChatGPT and Codex. - WIRED: April 30, 2026 report on OpenAI's rollout of the new high-security account mode. - Axios: April 30, 2026 coverage of OpenAI's shift toward passkeys and hardware-key-based protection. Mentions: OpenAI, ChatGPT, Codex, Yubico, Trusted Access for Cyber, Account security ## Sources - [OpenAI](https://openai.com/index/advanced-account-security/) - [WIRED](https://www.wired.com/story/openai-chatgpt-codex-advanced-account-security/) - [Axios](https://www.axios.com/2026/04/30/openai-chatgpt-logins-passkeys)