Kanary, a digital and physical attack surface management platform for people, announced the addition of ChatGPT as a source, detecting when personal data appears in ChatGPT-sourced intelligence, prioritizing findings across thousands of risks according to a personalized threat model, and taking steps to automatically mitigate the risks. A 2024 study by Cyberhaven found that 11% of data employees paste into ChatGPT is classified as confidential. In a 10,000-person organization, that is thousands of sensitive inputs every week, and almost none of them trigger a security alert under current tooling. Attackers are using unguarded AI systems like ChatGPT to coax out personal data through indirect prompting, assembling dossiers on executives and employees, and building targeted intelligence for social engineering attacks, impersonation campaigns, and physical threats. ChatGPT is designed to decline direct requests for personal data, but creative or indirect framing routinely defeats the guardrails. “We designed our first AI integration with ChatGPT and OpenAI working closely with our partners in banking, investment, and insurance,” said Rachel Vrabec, Founder and CEO, Kanary, noting that clients in the highly regulated financial services industry asked for an easy framework to show regulators they are leaders in adopting AI and safeguarding these new systems.