Windows desktop app loses ChatGPT authentication within 15–40 seconds after enabling Advanced Account Security; Codex CLI remains logged in

Summary

On Windows, the Codex/ChatGPT desktop app successfully signs in with ChatGPT, but loses the authenticated account state within approximately 15–40 seconds and returns to a signed-out state.

Important additional trigger/context: this started after I enabled Advanced Account Security on my OpenAI/ChatGPT account. I did not see this behavior before enabling that setting. I cannot prove that Advanced Account Security is the root cause, but the timing is strong enough that it may be relevant to the desktop authentication regression.

The same ChatGPT account remains authenticated and works normally in:

• ChatGPT Web
• Codex CLI

The issue is consistently reproducible in the Windows desktop app.

Environment

• OS: Windows
• Desktop package: OpenAI.Codex 26.814.5167.0
• Authentication method: Sign in with ChatGPT
• Account setting changed shortly before issue began: Advanced Account Security enabled
• Codex CLI: authenticated and working normally with the same account

codex login status after the desktop app has already lost authentication still reports:

Logged in using ChatGPT

Reproduction steps

1. Enable Advanced Account Security on the ChatGPT/OpenAI account.
2. Launch the Windows Codex/ChatGPT desktop app.
3. Sign in with ChatGPT in the browser flow.
4. Return to the desktop app.
5. Authentication initially succeeds.
6. Wait roughly 15–40 seconds.
7. The desktop app loses the authenticated account and returns to a login state.
8. Signing in again creates another Codex session, but the same failure repeats.

Relevant desktop log evidence

Immediately after sign-in:

[chatgpt-account-lookup] ...
authenticatedAccountPresent=true
authMethod=chatgpt
failureType=undefined
result=succeeded

About 15–40 seconds later:

[chatgpt-account-lookup] ...
authenticatedAccountPresent=false
authMethod=chatgpt
failureType=account_info_token_unavailable
result=failed

Immediately afterwards, authenticated desktop requests fail with 401:

status=401
{"detail":"Missing valid access token or actor biscuit"}

and:

status=401
{"detail":"Unauthorized"}

This cycle repeats after every re-login.

Examples observed in one session:

• Authentication succeeded at 07:15:26Z, became account_info_token_unavailable at 07:16:03Z (~37 seconds)
• Authentication succeeded at 07:17:00Z, failed at 07:17:16Z (~16 seconds)
• Authentication succeeded at 07:23:35Z, failed at 07:24:18Z (~43 seconds)
• Authentication succeeded at 07:28:33Z, failed at 07:28:57Z (~24 seconds)

Troubleshooting already performed

• Signed out of all active sessions and signed in again
• Reset the Windows desktop app
• Fully uninstalled the desktop app
• Rebooted Windows
• Reinstalled the desktop app
• Removed third-party Ark CLI injected Codex skills (arkcli +connect uninstall)
• Verified only one codex.exe app-server process was active during testing
• Verified ChatGPT Web stays logged in normally
• Verified Codex CLI stays logged in and works normally using the same ChatGPT account

The problem still reproduces after all of the above.

Expected behavior

After successful ChatGPT authentication, the Windows desktop app should keep the authenticated account state and continue using the valid session, including when Advanced Account Security is enabled.

Actual behavior

The desktop app loses the account token/state within less than one minute:

authenticatedAccountPresent=true
→ account_info_token_unavailable
→ authenticatedAccountPresent=false
→ HTTP 401
→ signed-out UI

Meanwhile, Codex CLI continues to work normally with the same account.

Related issue

The duplicate detector suggested #39162. That report is on macOS and is triggered by opening an existing conversation after a desktop update, but its auth failure sequence is notably similar (auth_token_missing / account_info_token_unavailable / HTTP 401). This Windows report differs in that the desktop app loses authentication on its own within 15–40 seconds, and the issue began after enabling Advanced Account Security.

I can provide additional redacted desktop logs if needed.

Start by reproducing the Windows desktop sign-in flow with Advanced Account Security enabled and inspect the desktop logs around the transition from authenticatedAccountPresent=true to account_info_token_unavailable. Compare the desktop behavior with the still-authenticated Codex CLI and the reported HTTP 401 responses. Done means the desktop app remains signed in and authenticated requests continue working after the first 15–40 seconds.