<img src="https://ml.globenewswire.com/Resource/Download/67a23434-df86-43c9-8300-728287725fd8?size=2" nborder="0" align="left" hspace="5" vspace="5" title="thekanary_logo (1).png" alt="Kanary"/>Kanary provides organizations with the AI governance, compliance and security capabilities needed to manage digital and physical threats, and satisfy regulatorsSAN FRANCISCO, July 28, 2026 (GLOBE NEWSWIRE) -- <a href="https://www.globenewswire.com/Tracker?data=7wpygzigR2CRRAjkXsD1Mgbk2yhaRF1YWwHz0bCFEnqKzbt-xSGlqEyjolcobM-MgumN3uhkcwIK4eo4W9_NxA==" rel="nofollow" target="_blank" title="Kanary">Kanary</a>, the digital and physical attack surface management platform for people, today announced the addition of ChatGPT as a source. Kanary now detects when personal data appears in ChatGPT-sourced intelligence, prioritizes findings across thousands of risks according to a personalized threat model, and takes steps to automatically mitigate the risks. How do you secure platforms designed to behave like humans? The exposure runs in both directions. Personal data that employees feed into prompts gets logged, potentially retained, and surfaced through AI intelligence channels in ways the originating organization cannot audit or revoke. And data that already exists inside AI models can be extracted through creative or indirect prompting, even when direct requests are refused. A 2024 study by Cyberhaven found that 11% of data employees paste into ChatGPT is classified as confidential. In a 10,000-person organization, that is thousands of sensitive inputs every week, and almost none of them trigger a security alert under current tooling. AI models are famously sycophantic. They are designed to please the user. Attackers understand this better than most security teams do. Rather than investing in expensive reconnaissance infrastructure, bad actors are using unguarded AI systems like ChatGPT to do the work for them: coaxing out personal data through indirect prompting, assembling dossiers on executives and employees, and building the kind of targeted intelligence that makes social engineering attacks, impersonation campaigns, and physical threats convincing enough to work. ChatGPT is designed to decline direct requests for personal data. For example, when asked for someone's home address, it will refuse. But the guardrails operate on intent, not on a hard lookup block, and creative or indirect framing routinely defeats them. Asking ChatGPT to write a story where a character named after a real person lives at a specific address, or to help draft a letter to a neighbor by name, can surface information a direct query would not. ”We designed our first AI integration with ChatGPT and OpenAI working closely with our partners in banking, investment, and insurance. The highly regulated financial services industry faces a shifting compliance landscape where a breach has a huge impact on their teams and clients. Our clients were asking us to set up an easy framework they could use to show regulators that they are leaders in both adopting AI and safeguarding these new systems,” said Rachel Vrabec, Founder and CEO, Kanary. "Now, security and compliance teams have visibility into the AI exposure surface and the audit records to prove they were watching it." How Kanary Monitors ChatGPT and Mitigates Threats Kanary runs continuous, passive monitoring across both ChatGPT's chat interface and developer APIs, which behave differently and can return different results. Kanary's proprietary collection infrastructure observes data surfacing across AI-generated content channels, and matches it against each member's asset inventory: their name, email addresses, phone numbers, employer, and pseudonyms. When a match is detected, Kanary does not just flag it. It acts. Each finding includes the source attribution, the matched entity, the estimated exposure window, and a structured mitigation action plan. For confirmed exposures, Kanary manages the removal process on the member's behalf, submitting requests directly through ChatGPT's privacy portal and pursuing retraining requests designed to prevent the same data from surfacing again. This is where Kanary's broader expertise in the human attack surface matters most. Understanding that a name appeared in a ChatGPT-sourced result is useful. Tracing the attacker’s path to a social media attack or impersonation account or phishing attempt is even more powerful. Knowing what combination of data is available across the internet and knowing what an attacker can do next, is what turns a detection into a defensible response. Kanary correlates findings across every source it monitors, so the mitigation plan reflects the full picture of an individual's exposure, not just the slice that surfaced in AI channels. The Compliance Gap Regulators Are Already Examining For risk and compliance teams, this is not only a security problem. The SEC's cybersecurity disclosure rules require public companies to disclose material incidents and describe their cybersecurity risk management processes annually. When a breach is discovered and the disclosure clock starts, organizations will be expected to show when the exposure began, what controls existed at the time, and how they responded. The situation is particularly acute for registered investment advisers. The SEC's 2023 cybersecurity rules require RIAs to implement written policies and procedures reasonably designed to detect and respond to cybersecurity incidents, and to maintain documentation demonstrating the adequacy of those controls. OCIE examination teams are now explicitly asking RIAs what technical controls they have around employee AI use. Most firms can answer the policy question. Almost none can answer the detection question, because no tool they currently own monitors for data exposure through AI channels. Every detection Kanary makes is logged, timestamped, and stored in a format designed to support regulatory examination, insurance claims, and legal proceedings. Kanary Was Purpose-Built To Address AI Risks And The Agentic Internet Kanary's ChatGPT capabilities are consistent with its founding mission and methodology, built on years of operationalized expertise in tracking how personal data moves from exposure to weaponization across the data broker ecosystem, search engines, social media, and now AI. That foundation is what allows Kanary to correlate a ChatGPT-sourced finding against the broader context of an individual's exposure profile, tell security teams not just that data surfaced, but what it enables, and take action to contain it. The platform is also available via API, so organizations can surface ChatGPT findings inside the security and compliance tools they already use. <a href="https://www.globenewswire.com/Tracker?data=faZhTzGAgGreNCjUtQyKmSs565-rx1-Wr3QxdQpZW0x7zHLxhLVDJU6hjnOMgaCLb5CiSSHJEXehrhCxflf0g3n_Ij3U7uD_hvpBp6Dt9QZEv5fMoUe8JrZQs5VBQ8_Tv4QXODDhtgGZ2QMsKgZkBY2GYs7NV8qwvNn0Yh4jYRKERZAFApPUtBm74QHtFa-aIXq2g3GQqZTiLuHw95z68ieK0D4bAi3a3VYKjEa9PQDfRHKWcNexFhU-gpMcsdZG" rel="nofollow" target="_blank" title="Book a demo">Book a demo</a> to learn more. About Kanary Kanary is the digital and physical attack surface management platform, for people. The platform builds a threat model for every individual, finds and mitigates active exposures, and delivers audit-ready intelligence. Kanary powers the protection of viral celebrities, non-profit leaders, grant makers, politicians, investors, corporate executives, board members, and their families and colleagues. The company is U.S. based, female founded, YC backed and SOC 2 certified. Learn more at <a href="https://www.globenewswire.com/Tracker?data=Pmj12p6bFjPT4dYf7H_OGoQo8hw3mXEuULF1HsbfUy_IKeXQxWeG7Gt2E47GNvU5bwB2DTUH42fI3TOuzvZ2MQ==" rel="nofollow" target="_blank" title="kanary.com">kanary.com</a>. FAQ What does Kanary's ChatGPT monitoring do? Kanary monitors for personal data associated with an organization's people appearing in <a href="https://www.globenewswire.com/Tracker?data=1-0hcSgdNlKHCb0_hWnr1xCqDrxY8kUbm4qciWg2yV9Kx2O74SMiZTDd-HvG0zirPG8Pz46nGDg4FEyUw1ootXvH3ejcziAAkTBI3RJM5Rah3mCt1-JFL_rjH6QA6ncakwmY_VFPCXJo9cWU6ovPgg==" rel="nofollow" target="_blank" title="ChatGPT">ChatGPT</a>-sourced intelligence. When a match is detected, Kanary surfaces a finding in the dashboard and initiates mitigation, including removal requests submitted through ChatGPT's privacy portal. It does not monitor live employee sessions, intercept prompts, or require any changes to how employees use ChatGPT. Does this require a partnership with OpenAI? No. Kanary's intelligence collection operates independently of any direct relationship with OpenAI, which means coverage is not gated by what a vendor chooses to share. Can't DLP tools or browser proxies handle this? No. Traditional DLP sits in the data path and cannot see data that has already left the corporate network and entered a third-party AI system. Browser proxies and CASB tools can restrict ChatGPT access on managed devices, but cannot control personal devices, vendor behavior, or exposures that occurred before a policy was in place. Kanary operates where those tools stop: outside the perimeter, in the AI intelligence channels where personal data surfaces after it has already been shared. Who is this for? Kanary's ChatGPT monitoring is included automatically for all Advanced Tier customers. The people who care most about it include: <ul type="disc"><li style="margin-top:5pt; margin-bottom:5pt;">Security and compliance teams at organizations where employees use AI tools regularly and leadership is starting to ask what controls exist around the data those tools touch.</li><li style="margin-top:5pt; margin-bottom:5pt;">Risk and compliance officers at financial institutions, healthcare organizations, and public companies operating under SEC, GDPR, HIPAA, or SOC 2 obligations who need audit records they can put in front of an examiner.</li><li style="margin-top:5pt; margin-bottom:5pt;">Registered investment advisers facing SEC examination teams that are now explicitly asking what technical controls exist around employee AI use. Legal counsel managing AI governance frameworks and breach notification exposure who need documentation that holds up when the clock is ticking.</li><li style="margin-top:5pt; margin-bottom:5pt;">Executive protection teams who understand that a home address or travel pattern surfacing through an AI system is not an abstract risk.</li><li style="margin-top:5pt; margin-bottom:5pt;">Physical security teams at organizations where what someone types into ChatGPT today can show up at a building entrance tomorrow. </li></ul> Kanary can be set up in five minutes and does not require internal integration. The platform complements employee benefit, executive protection, reputation, identify, and digital and physical risk programs. Kanary is also available via API for teams that want findings routed into the tools they already use. What happens when personal data is found? Kanary generates a structured finding with the matched entity, exposure window, and a mitigation action plan. For confirmed exposures, Kanary manages the removal process on the customer's behalf, including submission to ChatGPT's privacy portal and retraining requests where applicable. <pre>CONTACT: Media Contact
Mikala Vidal, Head of Growth
press@kanary.com</pre> <img alt="" src='https://ml.globenewswire.com/media/ZDcxMTRjOGItNWUyOC00Mjc4LWIwMmUtM2E3NzU1OGM0NTg5LTEzMjMzOTMtMjAyNi0wNy0yOC1lbg==/tiny/Kanary.png' referrerpolicy='no-referrer-when-downgrade' />

GlobeNewswire Inc.

Kanary Now Monitors ChatGPT for Personal Data Exposure, and Acts on What It Finds

Latest news from the world of business and finance – both local and global

MONEY FM 89.3 is Singapore's first and only Business and Personal Finance station, featuring local and international business and financial news.

MONEY FM 89.3

Discover newsletters from our DJs on LinkedIn