Advanced Account Security disables standard MFA state, but ChatGPT GitHub plugin requires MFA — authentication-policy deadlock

What issue are you seeing?

There appears to be an authentication-policy incompatibility between Advanced Account Security (AAS), Trusted Access for Cyber / Daybreak, and the ChatGPT GitHub plugin.

After AAS is enabled, the standard Multi-Factor Authentication state/control is no longer enabled or independently available in the normal way. However, connecting the GitHub plugin still requires Multi-Factor Authentication to be enabled.

Actual behavior:

• Keep AAS enabled → the GitHub plugin reports that MFA is required and blocks the connection.
• Disable AAS → standard MFA can be enabled, but the account loses the stronger AAS security posture required/intended for Trusted Access for Cyber.

The plugin appears to check a legacy MFA flag/state rather than the account's effective authentication assurance level. This prevents Trusted Access for Cyber users from using the GitHub plugin while retaining phishing-resistant AAS authentication and creates an incentive to downgrade security.

What steps can reproduce the bug?

1. Use an eligible personal ChatGPT account.
2. Go to Settings → Security.
3. Enable Advanced Account Security.
4. Complete AAS enrollment using the required secure authentication methods, such as passkeys and/or FIDO security keys.
5. Return to ChatGPT and attempt to connect the GitHub plugin.
6. Observe that the GitHub connection flow requires Multi-Factor Authentication.
7. The normal MFA state/control cannot independently satisfy that requirement while AAS is enabled.
8. The GitHub plugin therefore cannot be connected.

Reproducible as of August 20, 2026 (UTC+8).

What is the expected behavior?

Advanced Account Security should satisfy or supersede the GitHub plugin's MFA requirement. An account authenticated using phishing-resistant passkeys/FIDO security keys under AAS should not be treated as having a lower authentication assurance level than an account using standard MFA.

The GitHub plugin gate should recognize AAS/passkey/FIDO authentication as satisfying or exceeding the MFA requirement.

Additional information

Environment:

• Product: ChatGPT
• Feature: GitHub plugin / connector
• Account security: Advanced Account Security enabled
• Relevant program: Trusted Access for Cyber / Daybreak
• Authentication: AAS using phishing-resistant secure sign-in methods

Related issue: #25737 — "Codex CLI login forces SMS phone OTP step-up on a security-key-only (Advanced Account Security) account; browser login honors AAS"

Requested investigation:

1. Is Advanced Account Security intended to satisfy the GitHub plugin's MFA requirement?
2. Is this incompatibility a known issue?
3. Is there a supported workaround that does not require disabling AAS?
4. Can affected accounts have an incorrect or stale MFA/AAS assurance-state flag?
5. Can the plugin gate be updated to recognize AAS/passkey/FIDO authentication?

This is not a request for instructions on enabling MFA. Advanced Account Security is already enabled. Please treat this as an authentication-policy compatibility bug.