What Is ChatGPT Security and What Should Organizations Protect

An employee pastes source code into ChatGPT to troubleshoot an error. Another uploads a customer document for summarization. A third connects ChatGPT to company files so it can answer questions without copying information manually.

None of these actions are unusual. But each one gives the organization something new to manage. Company data may enter a ChatGPT conversation. A connected app may give ChatGPT access to internal information. An agent may be able to act through a user account.

ChatGPT security is therefore not limited to the controls built into ChatGPT. It also covers how employees use the service, what data they submit, which accounts they use, what company systems they connect, and what actions those connections permit.

As ChatGPT becomes more connected to business systems, data, identity, permissions, and agent actions become part of the same security problem.

ChatGPT security starts with data, identity, and access

For an organization, ChatGPT security means controlling how company information, user identities, connected services, and external actions are handled through ChatGPT.

Security teams need to know what information employees can place in prompts or uploads, whether employees use personal or company-managed accounts, which internal services are connected, what each connection can read or change, and which actions require approval.

The risk changes with the capability. A chatbot that receives text has a different risk profile from an agent that can read company files, access email, and perform actions in another service.

That distinction should shape how organizations approach ChatGPT security.

ChatGPT security has two sides

One side concerns the security and privacy controls provided by OpenAI. The other concerns how the organization configures and uses those controls.

OpenAI states that inputs and outputs from ChatGPT Business, Enterprise, Edu, and its API are not used to train its models by default. Users on personal Free, Plus, and Pro workspaces can turn off the setting that allows new conversations to be used for model improvement.

Provider controls do not decide what an employee is permitted to upload or which company services a user should connect. Those remain organizational decisions.

OpenAI also provides administrative controls for connected apps. Workspace administrators can control which apps are available, who can use them, which actions are available, and when approval is required.

ChatGPT security therefore depends on both sides working together. Provider controls set technical boundaries. Company policy sets acceptable use, access scope, ownership, and approval rules.

Sensitive data can leave company control through normal use

The prompt box creates one of the simplest ChatGPT security problems.

An employee may paste source code, customer information, financial records, credentials, internal emails, incident details, or configuration data because the information is needed to complete a task.

No malicious intent is required.

A 2025 NAACL industry study examined how employee queries to external LLM services can expose confidential company or client information. The researchers created and manually labelled a dataset of 1,500 queries to test methods for detecting sensitive information before submission.

The study does not document 1,500 real employee leaks. It demonstrates a research method for identifying sensitive information in enterprise queries before that information reaches an external model.

Organizations should define which data types may be entered into ChatGPT, which account types are approved for company work, and which tasks require a managed workspace.

A blanket ban can create another visibility problem if employees move to personal accounts or unapproved services. Clear usage rules, managed accounts, and suitable workspace controls give security teams a more workable model.

Account type changes the controls available

Personal ChatGPT use and managed business use should not be treated as the same security model.

OpenAI states that ChatGPT Business workspace data is excluded from model training by default and encrypted in transit and at rest. Users in a Business workspace have separate chat histories, and other workspace members do not automatically see those conversations.

Managed business offerings provide further organizational controls. OpenAI documents SAML SSO, access controls, control over connected internal sources, and other administrative settings across its business products.

Personal accounts use separate privacy and account settings.

That distinction belongs in ChatGPT security policy so employees know which account they should use for business work and which controls apply to it.

External content can become an instruction to the model

A user's prompt is not always the only instruction ChatGPT processes.

When ChatGPT reads webpages, files, emails, or information from connected systems, those sources can contain instructions too. An attacker may place instructions inside content that a model later reads. If those instructions alter model behavior, the technique is known as prompt injection.

OWASP ranks prompt injection as LLM01 in its 2025 list of risks for LLM applications. It separates direct prompt injection from indirect prompt injection. Indirect attacks arrive through outside content such as websites or files.

OpenAI describes prompt injection as an ongoing problem for agents that browse the web, retrieve information, and perform actions. Its 2026 research says input filtering alone is not enough because more advanced attacks can resemble social engineering rather than obvious malicious commands.

For ChatGPT security, outside content should be treated as information that may contain hostile instructions rather than trusted guidance for the system.

Web content can carry instructions the user never sees

Research reported by The Register in May 2026 showed how indirect prompt injection could affect webpage summarization in ChatGPT.

A researcher placed malicious instructions inside webpage content. When ChatGPT was asked to summarize the page during the demonstration, its response could include an attacker-controlled phishing link, a false security alert, or a QR code. The report described a research demonstration, not a large observed attack campaign.

OpenAI infrastructure did not need to be compromised for the demonstrated technique. The malicious instruction came from material the system was asked to process.

That changes the ChatGPT security model. Organizations have to think about the trustworthiness of information entering the model and what the model is permitted to do after processing it.

Connected apps turn model output into real actions

Prompt injection becomes more serious when ChatGPT can interact with other business systems.

OpenAI's current app documentation says apps may allow ChatGPT to read information or perform actions in connected services. Permission options can include Always ask, Any changes, Important actions, and Never ask. OpenAI describes Never ask as carrying elevated risk because actions can happen without a confirmation prompt.

The impact of manipulated model behavior depends partly on what the connected system can do.

OWASP describes excessive agency as the risk created when an LLM-based system receives more functions, permissions, or autonomy than its task requires. A manipulated system becomes more dangerous when it can send messages, modify records, call other services, or make changes outside the conversation.

NIST raised a related concern in 2026 when discussing identity and authorization for software agents. Its concept paper focuses on the risks that appear when software agents receive access to company data, tools, and applications, and calls for clear identity and authorization controls.

Least privilege therefore matters to ChatGPT security. An app that only needs to read calendar information should not receive unrelated write permissions.

Browser agents combine AI access with logged-in sessions

Browser agents can combine outside web content with a user's authenticated sessions.

University of Washington researchers tested seven agentic browsers in January and February 2026. Under the versions and settings tested, they demonstrated a cross-origin data theft proof of concept against ChatGPT Atlas in Agent Mode after a prompt injection succeeded. Researchers found conditions relevant to related attacks in several other agentic browsers as well.

The study does not show that every ChatGPT browser interaction has this weakness. It shows why browser architecture matters when an agent can read content across authenticated sessions and act with user access.

A text assistant that only summarizes information presents a different risk from a browser agent that can interact with logged-in websites.

ChatGPT security controls should reflect that difference.

Account security matters more as access grows

A compromised ChatGPT account can expose more than conversation history when that account has access to files, connected apps, or agent capabilities.

OpenAI introduced Advanced Account Security in April 2026 for eligible consumer accounts. It uses passkeys or compatible security keys, disables password sign-in and weaker recovery options, shortens active sessions, and adds account activity controls.

OpenAI states that Advanced Account Security is not available for enterprise-managed accounts. Managed organizations instead use workspace identity controls such as SSO and company authentication policy.

ChatGPT security should therefore sit within the organization's wider identity and access program. Account ownership, authentication, provisioning, offboarding, and access review should follow the same discipline applied to other business applications.

High-risk users may need fewer connected capabilities

More functionality is not appropriate for every user or every task.

OpenAI introduced Lockdown Mode in 2026 for people and organizations that want stricter limits when working with sensitive information or connected features. The setting limits many capabilities that connect to the web or external services to reduce data exfiltration risk from prompt injection.

Lockdown Mode does not make prompt injection impossible. Its purpose is to reduce what a successful manipulation can reach or transmit.

The principle applies beyond one product setting. A user handling sensitive records may need fewer connected actions than someone working only with public information.

What security teams need visibility into

ChatGPT security needs more than an acceptable-use document.

Security teams should know which ChatGPT workspaces employees use, which company domains are managed, which apps are connected, what permissions those apps hold, and which users can trigger external actions.

Data rules should state what information may be entered into prompts and uploads.

Connected apps should follow least privilege. Read access should not become write access without a business reason.

Higher-impact actions should require approval. OpenAI's workspace controls allow administrators to manage app availability, action scope, user roles, and approval behavior where those controls are supported.

Access should be reviewed when employees change roles or leave the organization.

Security teams should also follow changes in prompt injection techniques because agent capabilities, connected tools, and attack methods continue to change.

The operating questions remain consistent. Teams need to know what data the system can access, which identity is acting, which services are connected, and what the system can change.

ChatGPT security has moved beyond the prompt box

Early discussion about ChatGPT security focused heavily on what employees typed into a chatbot.

That still matters, but it is no longer the full problem.

Data can come from uploaded files and connected company systems. External content can influence model behavior. Apps and agents can carry that behavior into actions outside ChatGPT.

Security teams therefore need visibility into four areas. They need to know what data ChatGPT can access, which identity is using it, which systems are connected, and what actions those connections permit.

Provider controls matter, but organizational policy still determines how much access a user or agent receives.

As ChatGPT becomes more connected to business systems, managing those boundaries becomes the core ChatGPT security task.