« OpenAI ChatGPT Enterprise Assistant Advises Credential Rotation After Suspected Exposure OpenAI ChatGPT Enterprise Conversation Message Containing Credentials »
Elastic Docs ›Elastic Security [8.19] ›Downloadable rule update v8.19.36

OpenAI ChatGPT Enterprise Codex Prompt Containing Credentials

edit
IMPORTANT: This documentation is no longer updated. Refer to Elastic's version policy and the latest documentation.

OpenAI ChatGPT Enterprise Codex Prompt Containing Credentials

edit

Detects ChatGPT Enterprise Codex prompt or response text that matches known credential patterns. Secrets pasted into Codex sessions can be retained in compliance logs and may be reused by agent tool calls.

Rule type: esql

Rule indices: None

Severity: high

Risk score: 73

Runs every: 5m

Searches indices from: now-9m (Date Math format, see also Additional look-back time)

Maximum alerts per execution: 100

References:

Tags:

  • Domain: GenAI
  • Platform: OpenAI
  • Data Source: OpenAI ChatGPT Enterprise
  • Service: OpenAI ChatGPT Enterprise
  • Use Case: Threat Detection
  • Resources: Investigation Guide
  • Rule Type: ES|QL
  • Tactic: Credential Access
  • Mitre Atlas: AML.T0055

Version: 1

Rule authors:

  • Elastic

Rule license: Elastic License v2

Investigation guide

edit

Triage and analysis

Investigating OpenAI ChatGPT Enterprise Codex Prompt Containing Credentials

A Codex prompt or response matched a known credential pattern. Secrets pasted into Codex can be retained in compliance logs and may be reused by later tool calls in the same session.

Escalate when the value appears live, when tool or MCP activity follows the prompt, or when the same user repeats credential-like content. Close as a false positive for clearly synthetic or documentation examples.

Possible investigation steps

  • Read the prompt and response text on the alert and decide whether the match is a live secret, an example key, or incidental text.
  • Identify the user, Codex client, and session identifiers on the alert.
  • Check for nearby Codex tool calls, MCP activity, or access-token creation in the same session.
  • If the assistant response echoes the secret, treat that as additional exposure.

False positive analysis

  • Developers sometimes paste example keys while debugging or documenting integrations. Confirm the value is live before rotating it.

Response and remediation

  • If the credential is live, rotate or revoke it and review use of that credential after the prompt time.
  • Review Codex tool activity in the same session and remove residual copies from shared artifacts where possible.
  • Restrict who can read compliance logs that retain prompt text, because the alert may contain secret material.

Setup

edit

Setup

This rule requires the OpenAI ChatGPT Enterprise integration to collect compliance logs into Elasticsearch.

https://www.elastic.co/docs/reference/integrations/openai_chatgpt_enterprise

Rule query

edit
from logs-openai_chatgpt_enterprise.codex_log-* metadata _id, _version, _index
| eval Esql.prompt_text = coalesce(openai_chatgpt_enterprise.codex_log.event_details.prompt_text, "")
| eval Esql.response_text = coalesce(openai_chatgpt_enterprise.codex_log.event_details.response_text, "")
| where
    data_stream.dataset == "openai_chatgpt_enterprise.codex_log" and
    event.action == "prompt_response_received" and
    (
        (
        Esql.prompt_text is not null and
        Esql.prompt_text != "" and
        not Esql.prompt_text like "*AKIAIOSFODNN7EXAMPLE*" and
        not Esql.prompt_text like "*ASIAIOSFODNN7EXAMPLE*" and
        not Esql.prompt_text like "*ghp_example*" and
        not Esql.prompt_text like "*sk-ant-api03-test*" and
        (

        Esql.prompt_text rlike """.*(AKIA|ASIA)[A-Z0-9]{16}.*""" or
        Esql.prompt_text rlike """.*gh[pousr]_[A-Za-z0-9]{36}.*""" or
        Esql.prompt_text rlike """.*github_pat_[A-Za-z0-9_]+.*""" or
        Esql.prompt_text rlike """.*-----BEGIN [A-Z ]*PRIVATE KEY-----.*""" or
        Esql.prompt_text rlike """.*xox[baprs]-[0-9]+-[0-9]+-[A-Za-z0-9]+.*""" or
        Esql.prompt_text rlike """.*sk_live_[A-Za-z0-9]+.*""" or
        Esql.prompt_text rlike """.*AIza[-A-Za-z0-9_]+.*""" or
        Esql.prompt_text rlike """.*npm_[A-Za-z0-9]{36}.*""" or
        Esql.prompt_text rlike """.*sk-ant-[A-Za-z0-9-]+.*""" or
        Esql.prompt_text rlike """.*sk-[A-Za-z0-9]{20,}.*""" or
        Esql.prompt_text rlike """.*hvs[.][A-Za-z0-9]+.*""" or
        Esql.prompt_text rlike """.*dckr_pat_[-A-Za-z0-9_]+.*""" or
        Esql.prompt_text rlike """.*SG[.][-A-Za-z0-9_]+[.][-A-Za-z0-9_]+.*""" or
        Esql.prompt_text rlike """.*(AccountKey=|SharedAccessKey=)[-A-Za-z0-9+/=]+.*""" or
        Esql.prompt_text rlike """.*eyJ[-A-Za-z0-9_]+[.]eyJ[-A-Za-z0-9_]+[.][-A-Za-z0-9_]+.*"""
        )
    )
        or
        (
        Esql.response_text is not null and
        Esql.response_text != "" and
        not Esql.response_text like "*AKIAIOSFODNN7EXAMPLE*" and
        not Esql.response_text like "*ASIAIOSFODNN7EXAMPLE*" and
        not Esql.response_text like "*ghp_example*" and
        not Esql.response_text like "*sk-ant-api03-test*" and
        (

        Esql.response_text rlike """.*(AKIA|ASIA)[A-Z0-9]{16}.*""" or
        Esql.response_text rlike """.*gh[pousr]_[A-Za-z0-9]{36}.*""" or
        Esql.response_text rlike """.*github_pat_[A-Za-z0-9_]+.*""" or
        Esql.response_text rlike """.*-----BEGIN [A-Z ]*PRIVATE KEY-----.*""" or
        Esql.response_text rlike """.*xox[baprs]-[0-9]+-[0-9]+-[A-Za-z0-9]+.*""" or
        Esql.response_text rlike """.*sk_live_[A-Za-z0-9]+.*""" or
        Esql.response_text rlike """.*AIza[-A-Za-z0-9_]+.*""" or
        Esql.response_text rlike """.*npm_[A-Za-z0-9]{36}.*""" or
        Esql.response_text rlike """.*sk-ant-[A-Za-z0-9-]+.*""" or
        Esql.response_text rlike """.*sk-[A-Za-z0-9]{20,}.*""" or
        Esql.response_text rlike """.*hvs[.][A-Za-z0-9]+.*""" or
        Esql.response_text rlike """.*dckr_pat_[-A-Za-z0-9_]+.*""" or
        Esql.response_text rlike """.*SG[.][-A-Za-z0-9_]+[.][-A-Za-z0-9_]+.*""" or
        Esql.response_text rlike """.*(AccountKey=|SharedAccessKey=)[-A-Za-z0-9+/=]+.*""" or
        Esql.response_text rlike """.*eyJ[-A-Za-z0-9_]+[.]eyJ[-A-Za-z0-9_]+[.][-A-Za-z0-9_]+.*"""
        )
    )
    )
| keep
    _id, _version, _index, @timestamp, event.action, user.id, user.email,
    openai_chatgpt_enterprise.codex_log.client_id,
    openai_chatgpt_enterprise.codex_log.event_details.session_id,
    openai_chatgpt_enterprise.codex_log.event_details.prompt_text,
    openai_chatgpt_enterprise.codex_log.event_details.response_text,
    gen_ai.request.model, data_stream.*

Framework: MITRE ATT&CKTM

« OpenAI ChatGPT Enterprise Assistant Advises Credential Rotation After Suspected Exposure OpenAI ChatGPT Enterprise Conversation Message Containing Credentials »