ChatGPT Security Guide: What to Do Before the Next AI Attack

OpenAI’s AI models just escaped containment and hacked another company’s systems. While you can’t control what happens inside OpenAI’s labs, you can take immediate steps to secure your ChatGPT account before an AI-powered threat comes looking for your passwords, personal files, or private conversations.

Your ChatGPT history may include sensitive information: private conversations, uploaded documents, API keys connected to paid usage. Good account security can’t stop an AI from finding vulnerabilities inside a major company, but it can make your account far harder to compromise. Here’s how to lock it down.

Replace weak or reused passwords immediately. A unique password protects your account when another website suffers a breach. Use a password manager to create and store a strong password. To update it: Sign in to ChatGPT, open Settings, select Account, and update your password. If you registered through Google, Microsoft, or Apple, secure that external account instead. Also protect the email address connected to ChatGPT since password reset emails go there.

Add a passkey for stronger protection. A passkey lets you sign in without typing your password using a secure credential stored on your device or security key. It’s protected by Face ID, Touch ID, or your device PIN. To add one: Sign in on the web, go to Settings, select Security, find Passkeys, and select Add passkey. Warning: if you store a passkey on only one device and lose it, you could face access problems. A synced passkey offers easier backup.

Turn on multi-factor authentication. MFA adds another verification step during sign-in. Even if someone gets your password, they still need access to your second verification method. Go to Settings, select Security, find Multi-factor authentication, and choose your preferred method: authenticator app, push notification, text message, or passkey. OpenAI uses the most secure enabled option first when you have multiple methods available. Remember: enabling MFA doesn’t close sessions already active, so change any exposed password first, then review active sessions.

Review every active session regularly. Someone who gained access may remain signed in after you change security settings. Go to Settings, select Security, then Active sessions to see browsers and apps connected to your account. Remove suspicious sessions individually or log out of all sessions at once. This process may take up to 30 minutes.

Turn on Lockdown Mode for sensitive work. Lockdown Mode reduces the risk of data leaving ChatGPT during a prompt injection attack, where malicious instructions hide inside a website or uploaded file and try to manipulate how the AI handles sensitive information. Lockdown Mode limits outbound network access that an attacker could use to steal that information. To turn it on: Open Settings, select Security, find Advanced security, and turn on Lockdown Mode. Note: it cannot prevent every prompt injection from affecting a response.

Consider Advanced Account Security for eligible accounts. This feature replaces password-based access with passkeys or security keys only. It requires at least two secure sign-in methods with one working across devices. You must save recovery keys safely because losing all sign-in methods and recovery keys permanently locks you out. The benefit: conversations won’t be used to train OpenAI’s models while enabled.

Start with what’s available to your account today. Add stronger protections as they become available. Don’t wait for the next breach. Secure your ChatGPT account now.

Thank you for your support.

If you appreciate the work we do to spread the good news of Jesus Christ, please consider giving a gift to help us continue this work. Maranatha!