Kanary Now Monitors ChatGPT for Personal Data Exposure, and Acts on What It Finds

Skip to Content News Archives Economy Energy Oil & Gas Renewables Electric Vehicles Mining Commodities Agriculture Real Estate Mortgages Mortgage Rates Finance Banking Insurance Fintech Cryptocurrency Work Wealth Smart Money Wealth Management Investor Personal Finance Family Finance Retirement Taxes High Net Worth FP Comment Executive Women Puzzmo Newsletters Financial Times Business Essentials More Innovation Information Technology FP500 Podcasts Small Business Lives Told Tails Told Shopping Financial Post Store Obituaries Place a Notice Advertising Advertising With Us Advertising Solutions Postmedia Ad Manager Sponsorship Requests Classifieds Place a Classifieds ad Working Profile Settings My Subscriptions Saved Articles My Offers Newsletters Customer Service FAQ News Economy Energy Mining Real Estate Finance Work Wealth Investor FP Comment Executive Women Puzzmo Newsletters Financial Times Business Essentials This advertisement has not loaded yet, but your article continues below.HomeGlobeNewswireThis section is The content in this section is supplied by GlobeNewswire for the purposes of distributing press releases on behalf of its clients. Postmedia has not reviewed the content. by GlobeNewswire Kanary Now Monitors ChatGPT for Personal Data Exposure, and Acts on What It FindsAuthor of the article: You can save this article by registering for free here. Or sign-in if you have an account.Kanary provides organizations with the AI governance, compliance and security capabilities needed to manage digital and physical threats, and satisfy regulatorsTHIS CONTENT IS RESERVED FOR SUBSCRIBERS ONLYSubscribe now to read the latest news in your city and across Canada.Exclusive articles from Barbara Shecter, Joe O'Connor, Gabriel Friedman, and others.Daily content from Financial Times, the world's leading global business publication.Unlimited online access to read articles from Financial Post, National Post and 15 news sites across Canada with one account.National Post ePaper, an electronic replica of the print edition to view on any device, share and comment on.Daily puzzles, including the New York Times Crossword.SUBSCRIBE TO UNLOCK MORE ARTICLESSubscribe now to read the latest news in your city and across Canada.Exclusive articles from Barbara Shecter, Joe O'Connor, Gabriel Friedman and others.Daily content from Financial Times, the world's leading global business publication.Unlimited online access to read articles from Financial Post, National Post and 15 news sites across Canada with one account.National Post ePaper, an electronic replica of the print edition to view on any device, share and comment on.Daily puzzles, including the New York Times Crossword.REGISTER / SIGN IN TO UNLOCK MORE ARTICLESCreate an account or sign in to continue with your reading experience.Access articles from across Canada with one account.Share your thoughts and join the conversation in the comments.Enjoy additional articles per month.Get email updates from your favourite authors.THIS ARTICLE IS FREE TO READ REGISTER TO UNLOCK.Create an account or sign in to continue with your reading experience.Access articles from across Canada with one accountShare your thoughts and join the conversation in the commentsEnjoy additional articles per monthGet email updates from your favourite authorsSign In or Create an AccountSAN FRANCISCO, July 28, 2026 (GLOBE NEWSWIRE) — Kanary, the digital and physical attack surface management platform for people, today announced the addition of ChatGPT as a source. Kanary now detects when personal data appears in ChatGPT-sourced intelligence, prioritizes findings across thousands of risks according to a personalized threat model, and takes steps to automatically mitigate the risks.How do you secure platforms designed to behave like humans?Get the latest headlines, breaking news and columns.By signing up you consent to receive the above newsletter from Postmedia Network Inc.A welcome email is on its way. If you don't see it, please check your junk folder.The next issue of Top Stories will soon be in your inbox.We encountered an issue signing you up. Please try againThe exposure runs in both directions. Personal data that employees feed into prompts gets logged, potentially retained, and surfaced through AI intelligence channels in ways the originating organization cannot audit or revoke. And data that already exists inside AI models can be extracted through creative or indirect prompting, even when direct requests are refused. A 2024 study by Cyberhaven found that 11% of data employees paste into ChatGPT is classified as confidential. In a 10,000-person organization, that is thousands of sensitive inputs every week, and almost none of them trigger a security alert under current tooling.AI models are famously sycophantic. They are designed to please the user. Attackers understand this better than most security teams do. Rather than investing in expensive reconnaissance infrastructure, bad actors are using unguarded AI systems like ChatGPT to do the work for them: coaxing out personal data through indirect prompting, assembling dossiers on executives and employees, and building the kind of targeted intelligence that makes social engineering attacks, impersonation campaigns, and physical threats convincing enough to work.ChatGPT is designed to decline direct requests for personal data. For example, when asked for someone’s home address, it will refuse. But the guardrails operate on intent, not on a hard lookup block, and creative or indirect framing routinely defeats them. Asking ChatGPT to write a story where a character named after a real person lives at a specific address, or to help draft a letter to a neighbor by name, can surface information a direct query would not.”We designed our first AI integration with ChatGPT and OpenAI working closely with our partners in banking, investment, and insurance. The highly regulated financial services industry faces a shifting compliance landscape where a breach has a huge impact on their teams and clients. Our clients were asking us to set up an easy framework they could use to show regulators that they are leaders in both adopting AI and safeguarding these new systems,” said Rachel Vrabec, Founder and CEO, Kanary. “Now, security and compliance teams have visibility into the AI exposure surface and the audit records to prove they were watching it.”This advertisement has not loaded yet.This advertisement has not loaded yet, but your article continues below.How Kanary Monitors ChatGPT and Mitigates ThreatsKanary runs continuous, passive monitoring across both ChatGPT’s chat interface and developer APIs, which behave differently and can return different results. Kanary’s proprietary collection infrastructure observes data surfacing across AI-generated content channels, and matches it against each member’s asset inventory: their name, email addresses, phone numbers, employer, and pseudonyms.When a match is detected, Kanary does not just flag it. It acts. Each finding includes the source attribution, the matched entity, the estimated exposure window, and a structured mitigation action plan. For confirmed exposures, Kanary manages the removal process on the member’s behalf, submitting requests directly through ChatGPT’s privacy portal and pursuing retraining requests designed to prevent the same data from surfacing again.This is where Kanary’s broader expertise in the human attack surface matters most. Understanding that a name appeared in a ChatGPT-sourced result is useful. Tracing the attacker’s path to a social media attack or impersonation account or phishing attempt is even more powerful. Knowing what combination of data is available across the internet and knowing what an attacker can do next, is what turns a detection into a defensible response. Kanary correlates findings across every source it monitors, so the mitigation plan reflects the full picture of an individual’s exposure, not just the slice that surfaced in AI channels.The Compliance Gap Regulators Are Already ExaminingFor risk and compliance teams, this is not only a security problem. The SEC’s cybersecurity disclosure rules require public companies to disclose material incidents and describe their cybersecurity risk management processes annually. When a breach is discovered and the disclosure clock starts, organizations will be expected to show when the exposure began, what controls existed at the time, and how they responded.The situation is particularly acute for registered investment advisers. The SEC’s 2023 cybersecurity rules require RIAs to implement written policies and procedures reasonably designed to detect and respond to cybersecurity incidents, and to maintain documentation demonstrating the adequacy of those controls. OCIE examination teams are now explicitly asking RIAs what technical controls they have around employee AI use. Most firms can answer the policy question. Almost none can answer the detection question, because no tool they currently own monitors for data exposure through AI channels. Every detection Kanary makes is logged, timestamped, and stored in a format designed to support regulatory examination, insurance claims, and legal proceedings.Kanary Was Purpose-Built To Address AI Risks And The Agentic InternetKanary’s ChatGPT capabilities are consistent with its founding mission and methodology, built on years of operationalized expertise in tracking how personal data moves from exposure to weaponization across the data broker ecosystem, search engines, social media, and now AI. That foundation is what allows Kanary to correlate a ChatGPT-sourced finding against the broader context of an individual’s exposure profile, tell security teams not just that data surfaced, but what it enables, and take action to contain it. The platform is also available via API, so organizations can surface ChatGPT findings inside the security and compliance tools they already use.Book a demo to learn more.Kanary is the digital and physical attack surface management platform, for people. The platform builds a threat model for every individual, finds and mitigates active exposures, and delivers audit-ready intelligence. Kanary powers the protection of viral celebrities, non-profit leaders, grant makers, politicians, investors, corporate executives, board members, and their families and colleagues. The company is U.S. based, female founded, YC backed and SOC 2 certified. Learn more at kanary.com.What does Kanary’s ChatGPT monitoring do?Kanary monitors for personal data associated with an organization’s people appearing in ChatGPT-sourced intelligence. When a match is detected, Kanary surfaces a finding in the dashboard and initiates mitigation, including removal requests submitted through ChatGPT’s privacy portal. It does not monitor live employee sessions, intercept prompts, or require any changes to how employees use ChatGPT.Does this require a partnership with OpenAI?No. Kanary’s intelligence collection operates independently of any direct relationship with OpenAI, which means coverage is not gated by what a vendor chooses to share.Can’t DLP tools or browser proxies handle this?No. Traditional DLP sits in the data path and cannot see data that has already left the corporate network and entered a third-party AI system. Browser proxies and CASB tools can restrict ChatGPT access on managed devices, but cannot control personal devices, vendor behavior, or exposures that occurred before a policy was in place. Kanary operates where those tools stop: outside the perimeter, in the AI intelligence channels where personal data surfaces after it has already been shared.Kanary’s ChatGPT monitoring is included automatically for all Advanced Tier customers. The people who care most about it include:Security and compliance teams at organizations where employees use AI tools regularly and leadership is starting to ask what controls exist around the data those tools touch.Risk and compliance officers at financial institutions, healthcare organizations, and public companies operating under SEC, GDPR, HIPAA, or SOC 2 obligations who need audit records they can put in front of an examiner.Registered investment advisers facing SEC examination teams that are now explicitly asking what technical controls exist around employee AI use. Legal counsel managing AI governance frameworks and breach notification exposure who need documentation that holds up when the clock is ticking.Executive protection teams who understand that a home address or travel pattern surfacing through an AI system is not an abstract risk.Physical security teams at organizations where what someone types into ChatGPT today can show up at a building entrance tomorrow.Kanary can be set up in five minutes and does not require internal integration. The platform complements employee benefit, executive protection, reputation, identify, and digital and physical risk programs. Kanary is also available via API for teams that want findings routed into the tools they already use.What happens when personal data is found?Kanary generates a structured finding with the matched entity, exposure window, and a mitigation action plan. For confirmed exposures, Kanary manages the removal process on the customer’s behalf, including submission to ChatGPT’s privacy portal and retraining requests where applicable.Media Contact Mikala Vidal, Head of Growth press@kanary.comNotice for the Postmedia NetworkThis website uses cookies to personalize your content (including ads), and allows us to analyze our traffic. Read more about cookies here. By continuing to use our site, you agree to our Terms of Use and Privacy Policy.