When an employee uses a personal ChatGPT account on a corporate laptop (even at an organisation that pays for ChatGPT Enterprise) the security implications can range from trivial to serious. A sponsored guide published on BleepingComputer, written by Vakaris Noreika, VP of Product Research and Development at NordLayer, walks IT admins through the five steps that follow a personal ChatGPT at work alert, and illustrates what changes when prompt-level controls are in place.
The piece opens with a reminder that the risk is real at every level. As background: reporting by Politico in January 2026, covered by CSO Online, revealed that Madhu Gottumukkala, who had led CISA since May 2025, uploaded at least four documents marked ‘for official use only’ to OpenAI’s ChatGPT platform. Cybersecurity sensors detected the activity in early August 2025, generating several alerts in the first week alone, according to CSO Online citing four Department of Homeland Security officials. CISA’s Director of Public Affairs, Marci McCarthy, said at the time that Gottumukkala ‘was granted permission to use ChatGPT with DHS controls in place’ and that ‘this use was short-term and limited.’
Identifying the account and what reached ChatGPT
Noreika’s guide frames the response as two parallel tracks: what an admin can do with standard tooling, and what becomes possible with NordLayer’s AI Scout product deployed on a managed browser. Step one is confirming who is involved. With standard tools, a flagged event may show a corporate login to your security platform but a personal Gmail address behind the actual ChatGPT session, one person, two identities. Without prompt-level visibility, step two is harder: the retained event log holds no prompt text, so the admin must ask the employee to produce the conversation, keeping the request tightly scoped to the relevant exchange.
The article puts the most common explanation bluntly. According to Noreika, ‘there’s a 99% chance that the explanation is mundane’: the corporate session had expired, two-factor authentication took too long, and a personal ChatGPT tab was already open. In the scenario the guide constructs, the employee pasted a customer support ticket into the chat and hit the send button. Where no prompt-blocking rule was configured, the submission went through to ChatGPT.
Responding, documenting and fixing the workflow
Once the contents of what reached ChatGPT are confirmed, Noreika advises preserving evidence and bringing in the incident, privacy or data owner. The severity depends on what was shared: exposed credentials require revocation or rotation; customer records may need a privacy assessment; pasted public text is not a data incident at all. The guide also cautions against overclaiming in the write-up, using a personal account does not by itself prove that a prompt entered model training, became public or reached another user.
Step five is fixing the underlying workflow before closing the ticket. Noreika recommends helping the employee get back into the Enterprise workspace and verifying that the task and data are permitted there, because an Enterprise subscription does not mean all content is automatically acceptable. The admin should then record details covering the account, the device, what the prompt contained, whether it was actually transmitted, and who holds responsibility for the follow-up, before scheduling a check for repeat events.
Throughout, the article contrasts the standard approach with NordLayer AI Scout’s claimed capabilities, on-device prompt inspection, configurable ‘Warn’, ‘Redact’ and ‘Block’ actions, and activity tied to a work identity via MDM and directory sync with Entra ID, Okta or HiBob. Those capabilities are presented as the vendor’s own claims in a piece that NordLayer sponsored and authored; BleepingComputer labels it accordingly.
According to Politico’s January 2026 report, Gottumukkala subsequently held discussions with CISA’s chief information officer Robert Costello and chief counsel Spencer Fisher, covering both the incident itself and how ‘for official use only’ material should be handled, a reminder that even when controls are in place, process conversations still follow.
