OpenAI has introduced an Advanced Account Security program that lets users protect ChatGPT and platform accounts with passkeys and hardware security keys. The company framed the feature as a stronger option for users who face targeted phishing risks, including journalists, researchers, public figures, developers, and organizations managing sensitive AI workflows.
The program supports passkeys and YubiKeys as phishing-resistant authentication methods. OpenAI said users can register a passkey through account settings, while Yubico said it is working with OpenAI on custom security keys designed for OpenAI users. The approach gives account holders a way to bind access to a device or hardware authenticator rather than relying on passwords or one-time codes that can be intercepted.
The move reflects the growing security importance of AI accounts. Access to a compromised account can expose chat history, API usage, proprietary prompts, uploaded files, and enterprise workflow data. For developers, account takeover can also create risk around billing abuse or unauthorized use of connected systems. Stronger authentication is therefore becoming part of the identity infrastructure around AI services, not just a consumer account setting.
The release also connects to a broader identity problem emerging around AI agents and delegated digital activity. VeryAI recently launched a palm biometrics platform for AI agent identity, while Proof joined the FIDO Alliance to work on identity standards for AI agents. OpenAI’s update addresses the user account side of that ecosystem, where stronger authentication helps establish who is controlling access to AI systems.
Passkeys are based on public-key cryptography and are designed to resist phishing because the credential is tied to the legitimate service. Hardware security keys provide a similar phishing-resistant model for users and organizations that want a separate physical authenticator. Both methods are especially relevant for AI platforms because access credentials can unlock not only a user interface, but also APIs, stored files, and connected automation.
OpenAI’s Advanced Account Security is available from account security settings. The company’s help documentation says users should register more than one passkey or security key where possible, reducing the risk of being locked out if a device is lost.
Sources: OpenAI, OpenAI, Yubico
–
By Ali Nassar-Smith
