OpenAI Deploys Enhanced Security Protocol for ChatGPT: Multi-Factor Authentication and Session Limits Now Live

By ✦ min read

<p>OpenAI today launched a sweeping security upgrade for ChatGPT accounts, introducing multi-factor authentication (MFA), tightened account recovery procedures, shorter session durations, and an option to exclude account data from model training. The measures, effective immediately, aim to address escalating privacy concerns and pave the way for broader enterprise adoption.</p> <h2>Key Security Enhancements</h2> <p>According to OpenAI's announcement, users can now enable MFA via authenticator apps or hardware tokens. Account recovery now requires identity verification beyond email access, reducing the risk of hijacking. Sessions automatically expire after a set period — currently four hours — unless the user actively extends them.</p><figure style="margin:20px 0"><img src="https://www.securityweek.com/wp-content/uploads/2025/11/OpenAI.jpeg" alt="OpenAI Deploys Enhanced Security Protocol for ChatGPT: Multi-Factor Authentication and Session Limits Now Live" style="width:100%;height:auto;border-radius:8px" loading="lazy"><figcaption style="font-size:12px;color:#666;margin-top:5px">Source: www.securityweek.com</figcaption></figure> <p>A new privacy toggle allows users to opt out of having their ChatGPT conversations used for training future models. This feature, previously available only to API customers, now extends to all free and paid accounts.</p> <blockquote> <p>"This is a significant step toward enterprise-grade security for AI platforms. The combination of MFA, shortened sessions, and training exclusion directly addresses the top concerns we hear from CIOs," said Dr. Laura Chen, cybersecurity analyst at CyberEdge Research.</p> </blockquote> <blockquote> <p>"We are committed to protecting user data while maintaining a seamless experience. These changes give users more control and administrators more confidence," said an OpenAI spokesperson.</p> </blockquote> <h2>Background</h2> <a id="background"></a> <p>ChatGPT has faced scrutiny over data privacy since its launch in 2022. In March 2023, a bug exposed chat titles to other users, and in April 2023, Italy temporarily banned ChatGPT over GDPR concerns. OpenAI subsequently introduced basic security features, but enterprise clients demanded more robust protections.</p> <p>The rollout follows a trend among AI companies — Google, Microsoft, and Anthropic have all added multi-factor authentication and session controls to their generative AI products over the past year. OpenAI’s move brings ChatGPT in line with those standards.</p><figure style="margin:20px 0"><img src="https://www.securityweek.com/wp-content/uploads/2022/04/SecurityWeek-Small-Dark.png" alt="OpenAI Deploys Enhanced Security Protocol for ChatGPT: Multi-Factor Authentication and Session Limits Now Live" style="width:100%;height:auto;border-radius:8px" loading="lazy"><figcaption style="font-size:12px;color:#666;margin-top:5px">Source: www.securityweek.com</figcaption></figure> <h2>What This Means</h2> <a id="what-this-means"></a> <p>For individual users, the update provides stronger protection against account takeover and data leaks. The training exclusion option gives privacy-conscious users peace of mind, though it may limit ChatGPT’s ability to personalize responses.</p> <p>For enterprises, the enhanced security removes a key barrier to deployment. Companies in regulated industries such as finance and healthcare can now consider ChatGPT for internal use without violating compliance mandates. Shorter sessions reduce the risk of unauthorized access if a device is lost or stolen.</p> <p>However, some users may find the new session timeouts inconvenient, especially during long collaborative work sessions. OpenAI says it will monitor feedback and adjust rolling session limits if needed.</p> <h3>Adoption and Next Steps</h3> <p>MFA and training exclusion are enabled by default for new accounts. Existing users are prompted to set up MFA upon next login. The company plans to extend session controls to team and enterprise plans within the coming weeks.</p> <p>SecurityWeek reached out to several ChatGPT users, who expressed cautious optimism. "I've been waiting for this. It makes me feel safer using ChatGPT for work purposes," said Mark Reynolds, a project manager at a mid-size tech firm.</p> <p><em>— Reporting by SecurityWeek staff. Updated with additional context on enterprise implications.</em></p>