Frontier Forensics: Open AI

TL;DR 

AI adoption is creating new incident response challenges, especially as organizations use multiple AI platforms with different logging and retention models. This first guide in Invictus’ AI investigation series focuses on OpenAI, covering ChatGPT Workspace and the API Platform, what evidence is available, where logging gaps exist, and what responders need to have enabled before an incident. Claude, Gemini, and Copilot will be up next.

Introduction

Hit the floor at Black Hat this year and everything is AI-powered and agentic. It was the same story at RSA. This is just the security side of what is taking place in corporate. Every organization is adopting AI and forcing its usage, often across multiple platforms at once. We recently attended a CISO summit where AI governance was a hot topic. There were some great practical takeaways shared, along with pain points that just have not matured into a solution yet.

These observations are signals that incidents are not just going to be AI-driven. They are going to happen around the users in an organization who rely on AI platforms and tools, and around threat actors using those same tools inside the network. We are already seeing it in our investigations. Developers in particular use dozens of AI tools, which means dozens of logging sources and a requirement for familiarity with each platform.That is where this new Invictus series comes into play.

This series takes one platform at a time and maps its practical investigative requirements to build up practical IR knowledge. We fully expect these guides to change as AI changes, and more importantly as our own investigations hand us the next round of lessons learned. We are starting with one of the more popular platforms, OpenAI. Claude, Gemini, and Microsoft Copilot are up next, with plans to move into the more SaaS and developer heavy tools space. 

First up: OpenAI

One quick note before we dive in. We are not going to cover individual subscriptions, because guess what, there is no logging available. It is still something to flag if users in an organization are working from personal accounts, as it creates a blind spot for both detection and response efforts. Instead we are going to focus on ChatGPT Workspace and The API Platform. 

ChatGPT Workspace is where your users live day to day. For Enterprise and Edu organizations, the Compliance Logs Platform gives you a window into user, authentication, administrative, and supported product activity. The API Platform is a different beast entirely. Its Audit Logs cover identities, credentials, permissions, projects, network controls, and organization configuration. 

The full paper explores these areas in greater depth, but a few key points are worth highlighting.

• Enterprise and Edu organizations have access to 30 days of retained evidence through the Compliance Logs Platform. 
• API Platform Audit Logs, however, must be enabled before an incident occurs in order to be available for investigation. 
• Retention varies across OpenAI evidence sources. Some data has defined retention periods, some is retained on a best-effort basis, and some may be unavailable depending on configuration, product usage, or data retention settings.

Get the paper

If you respond to incidents, work in a SOC, or are focused on AI security, this is the reference you need!

Click here to download the full OpenAI investigation paper.

OpenAI is where we start. Claude, Gemini, and Copilot are already in the queue, so keep an eye out for the next entry in the series.

About Invictus Incident Response

We're an incident response company at heart, and investigating AI platforms is where the discipline is heading. We've handled the full range of incidents across AWS, Azure, and Google Cloud, and because the compute behind AI mostly lives in that same cloud, the hard-won experience we built there is exactly what makes us ready for what comes next. We love the cloud, and we're bringing everything it taught us to the next frontier. We help our clients stay undefeated.

🆘 For incident response support reach out to cert@invictus-ir.com or go to https://www.invictus-ir.com/24-7