Detects ChatGPT Enterprise user messages that combine two or more common jailbreak techniques: overriding prior or system instructions, switching the assistant into an unrestricted persona or mode (for example DAN or developer mode), asking it to operate without safety restrictions or filters, or asking it to reveal its system prompt. Jailbreak prompts stack these techniques to talk the model out of its safety policy, and a user doing so in a managed workspace may be attempting to generate prohibited content or to probe the workspace's controls. Requiring more than one technique keeps documents that merely quote a single jailbreak phrase from alerting.

Read More

Detects ChatGPT Enterprise audit events where a user role is updated to account-owner. Account owners control workspace membership, connectors, usage limits, and other security-sensitive settings. An adversary who promotes a compromised account to owner gains durable control-plane access.

Read More

Detects ChatGPT Enterprise app authentication events that link a third-party app to a user or workspace. Linking apps establishes durable OAuth-style access that adversaries can use to persist connectors after initial compromise.

Read More

Detects ChatGPT Enterprise assistant messages that recognize likely exposed secrets in chat and advise rotating, revoking, regenerating, invalidating, or deactivating credentials (API keys, access keys, passwords, tokens, and similar). Users or adversaries who paste live secrets into conversations create credential-exposure risk; the assistant's rotation advice is a strong signal that a secret was present in the prior turns.

Read More

Detects successful ChatGPT Enterprise authentication events where the user agent looks scripted (for example Python, curl, Go HTTP clients, aiohttp, scrapers, or headless browsers) rather than a normal browser. Adversaries and automation often reuse stolen sessions or tokens with non-browser clients.

Read More

Detects ChatGPT Enterprise Codex events that create an access token. Codex access tokens enable automated CLI or environment access and can be abused for persistence or lateral automation after account compromise. Treat tokens with a missing expires_at as higher priority during triage.

Read More

Detects ChatGPT Enterprise Codex prompt or response text that matches known credential patterns. Secrets pasted into Codex sessions can be retained in compliance logs and may be reused by agent tool calls.

Read More

Detects ChatGPT Enterprise Codex security-log events that create or update a repository scan configuration. Changing scan scope, lookback, or notification rules can weaken secrets scanning coverage or redirect findings.

Read More

Detects ChatGPT Enterprise conversation messages whose text matches known credential patterns (cloud keys, GitHub tokens, private keys, Slack/SendGrid tokens, Stripe/OpenAI/Anthropic keys, Vault/Docker tokens, JWTs, or Azure storage keys). Secrets pasted into chats can be retained in compliance logs and model context.

Read More

Detects ChatGPT Enterprise audit events where a conversation is shared. Sharing can expose prompts, completions, and attached files outside the original conversation participants and may be used to exfiltrate sensitive content.

Read More

Detects ChatGPT Enterprise custom-agent publish events (agent_published). Publishing an agent with connectors, skills, or store visibility can establish durable automation and broaden data access beyond the original user.

Read More

Detects ChatGPT Enterprise custom-agent events that create or update a trigger. Triggers can schedule or event-drive agent runs without interactive user presence, enabling persistence and automation abuse.

Read More

Detects ChatGPT Enterprise audit events that create a workspace domain boundary entry. Domain changes can expand who is allowed to join or access the tenant and may establish persistence for attacker-controlled domains.

Read More

Detects an unusually high number of ChatGPT Enterprise conversation deletion events for the same user within a rolling 24-hour lookback. Mass deletion can indicate an attempt to remove conversation history or cover tracks after misuse.

Read More

Detects ChatGPT Enterprise Gmail connector send_email responses. Adversaries who abuse a linked Gmail connector after session compromise can exfiltrate data or perform lateral phishing by sending mail on behalf of the user. Draft-only activity (create_draft) is excluded.

Read More

Detects a ChatGPT Enterprise user downloading five or more distinct Google Drive files through the Drive connector within a one-hour window. Adversaries who abuse a linked Drive connector after session compromise often stage bulk file retrieval before sharing, forwarding, or other exfiltration.

Read More

Detects a ChatGPT Enterprise user issuing five or more distinct Google Drive app search queries in a five-minute bucket where at least one query matches sensitive-data themes (payroll, payslip, confidential, payment, NDA, credentials, and similar). Adversaries who abuse a linked Drive connector after session compromise often run rapid multi-term searches to locate high-value files before download or sharing.

Read More

Detects a ChatGPT Enterprise Codex user invoking a high number of distinct MCP tools across multiple connectors within a 30-minute bucket. Broad tool and connector diversity in a short window can indicate compromised-account recon, unauthorized multi-system collection, or an agent rapidly enumerating organizational data sources.

Read More

Detects a high number of ChatGPT Enterprise file download audit events for the same user within a rolling 24-hour lookback. Bulk downloads can indicate staging of conversation attachments or workspace files for exfiltration.

Read More

Detects successful ChatGPT Enterprise logins for the same user email from source IPs whose geo-locations are separated by at least 1,000 km, with implied travel faster than 800 km/h, within a 24-hour window. That pattern can indicate account sharing, VPN or proxy egress mismatches, or an adversary authenticating from a geography far from the legitimate user's baseline.

Read More

Detects ChatGPT Enterprise audit events that delete stored memory. Adversaries may delete memory entries to remove evidence of prior prompts, preferences, or staging instructions after misuse.

Read More

Detects multiple failed ChatGPT Enterprise login attempts for the same user email within a short window. Password spraying or credential stuffing against enterprise accounts often precedes a successful compromise.

Read More

Detects three or more ChatGPT Enterprise assistant messages for the same user whose text matches common policy-refusal phrases (cannot assist, cannot help, cannot fulfill, unable to assist, against my guidelines, and similar) within the lookback window. A refusal burst can indicate jailbreak probing, policy-bypass attempts, or automated unsafe prompting intended to evade model safety controls.

Read More

Detects ChatGPT Enterprise audit events that publish a GPT or update sharing for GPTs, skills, or projects (gpt_publish, update_sharing, skill_share, project_update_sharing). Broadening share scope can expose custom instructions, tools, or proprietary agent configurations beyond the original audience.

Read More

Detects a ChatGPT Enterprise user issuing ten or more distinct Slack app search queries in a five-minute bucket. Adversaries who abuse a linked Slack connector after session compromise often run rapid multi-query searches across channels and messages to locate sensitive content before collection or exfiltration.

Read More

Detects ChatGPT Enterprise Gmail connector searches that look like sensitive discovery: attachment hunts across multiple document types, or queries matching credential, financial, HR, or legal themes. Attackers abusing a linked Gmail connector after session compromise often search mail for high-value content before exfiltration or send-as abuse.

Read More

Detects the first ChatGPT Enterprise Codex MCP tool name used by a given user email within an organization in the rule history window. Codex MCP tools can query external systems and pull organizational data into an agent session. Alerting on first-seen organization, user, and tool triples highlights new or unexpected connector usage rather than every routine approved tool call.

Read More

Detects the first ChatGPT Enterprise Codex plugin install for a given plugin display name and plugin name pair within the rule history window. Newly installed Codex plugins expand the tools and data sources available inside agent sessions; adversaries can enable unexpected connectors to persist access to mail, chat, or file systems after initial compromise.

Read More

Detects the first time a ChatGPT Enterprise MCP app name is used by a given user email within an organization in the rule history window. MCP apps connect ChatGPT to external systems and can move organizational data into third-party tools. Alerting on first-seen organization, user, and app id triples highlights new or unexpected connector usage rather than every routine approved MCP request. App name is still required in the query for investigation context.

Read More

Detects ChatGPT Enterprise activity for the same user email from at least three countries and two unique user agents within a four-hour interval across any compliance data stream. Stolen session cookies often produce post-auth activity (conversation views, deletions, downloads) without a new login event, so this rule is not limited to authentication logs.

Read More

Detects ChatGPT Enterprise audit events that invite a new user into the workspace. An adversary who compromises an administrator can invite a mailbox they control to gain durable access.

Read More

Detects ChatGPT Enterprise audit events that toggle a workspace feature flag (for example GPT sharing). Adversaries may enable sharing or weaken controls to persist access or broaden data exposure.

Read More

Detects ChatGPT Enterprise audit events where a workspace compliance log file is deleted (delete_workspace_log_file). Adversaries with privileged access may delete exported audit or conversation log archives to remove evidence from compliance workflows and hinder investigation.

Read More

Detects ChatGPT Enterprise audit events where workspace compliance log files are listed or downloaded. Attackers pull audit and conversation exports to understand defender visibility or stage sensitive transcript data before further abuse.

Read More