OpenAI Introduces Account Security History for ChatGPT Auditing

OpenAI published an update to ChatGPT's release notes on September 25, 2026, launching a new 'Security History' tool under account settings. The feature provides users and organization members with a central audit log of account-level lifecycle and authentication events. Users can now inspect historical sign-ins, sign-outs, and alterations made to security parameters—including multi-factor authentication (MFA) changes and passkey registrations—paired with approximate geographic locations, event timestamps, and client device details. For DevOps, platform engineers, and SecOps teams, identity security surrounding AI accounts has become a critical operational surface. Because ChatGPT instances frequently interface with proprietary codebases, external connectors, and sensitive company documents via plugins, compromised credentials represent an immediate lateral movement vector into internal systems. The absence of native, easily reviewable access history forced many organizations to rely exclusively on upstream identity providers (IdPs) via Enterprise SSO, leaving standard Plus and Pro developer accounts unmonitored. This release brings baseline identity auditing directly into the native web UI. The introduction of native access history aligns with an industry-wide push toward zero-trust principles in AI workspace management. Over the past year, AI clients have expanded from simple conversational endpoints into agentic systems connected to code repositories, internal documents, and enterprise APIs. As conversational interfaces handle privileged tasks, the blast radius of unauthorized credential access has grown substantially. Introducing explicit event-level transparency reflects the standard hardening pattern seen across modern cloud infrastructure and developer-focused SaaS platforms. In practice, security engineers and team leads should instruct members using non-SSO ChatGPT tiers to regularly audit their Security History under Settings > Security and Login. While approximate location and device metrics help identify anomalous sessions, organizations operating at scale must still ensure critical developer accounts enforce hardware MFA or passkeys. Teams should treat ChatGPT as a privileged endpoint and establish operational runbooks for session invalidation whenever unrecognized sign-ins or MFA alterations are surfaced in the log.