What changed
OpenAI introduced Advanced Account Security using passkeys or hardware security keys, disabling passwords, email and SMS codes, and email recovery while adding recovery keys and shorter sessions.
Why it matters
High-value ChatGPT accounts gained a stronger authentication mode that reduces phishing exposure but also makes authenticator and recovery-key loss much more consequential.
What to do
Enroll at least two authenticators, store recovery keys offline in separate approved locations, review active sessions, test recovery, and document offboarding before enabling.
Caveat
Losing every authenticator and recovery key can permanently lock the account, availability can vary, and stronger login does not control unsafe plugins, prompts, or shared content.