How easy is it to hack an account across different AI platforms without the user realizing it? Active sessions are one of the first things to check. The answer doesn’t just lie in a suspicious email. An unknown device, an unexpected change in settings, or unusual usage can all indicate that someone has gained access.
A guide published by TechCrunch on August 15th looks at how to check for ChatGPT, Claude, and Perplexity. The three services don't work in exactly the same way, but they all give the user some immediate protection.
See also: GPT-5.6-Cyber: OpenAI lowers the bar on vulnerability research
Active sessions on AI platforms
In ChatGPT, control is done from the browser. The user opens Settings, selects the security and connection section, and then active sessions. There, they can see the connected devices and remove an unknown device or choose to log out of all devices.
If a password change is required, ChatGPT first requires you to log out of your account. From the login screen, the “Forgot password” option initiates a reset process via email and a six-digit code. OpenAI’s official guidance also recommends a unique password, multifactor authentication, and logging out of all active sessions.
In Claude, the user goes to Settings and the account section, where active sessions are displayed. An unknown session can be terminated individually or logged out from all devices. The service does not use passwords; login is done via a link sent to the registered email address.
What about Perplexity?
Perplexity takes a different approach. The service does not display a list of connected devices or sessions, so the user cannot isolate an unknown login. If a breach is suspected, the safest option is to log out of all sessions and log in again with an email and a unique six-digit code.
This visibility gap matters: the absence of an unknown device from a control screen does not prove that the account is secure. The user must combine session control with observation of conversations, settings, notifications, and charges.
See also: iPhone 18 pre-order scams: How to avoid falling for phishing
How account security is enhanced
The basic defense for any AI platform is a unique password stored in a password manager. Multi-factor authentication adds a second step and limits the value of a stolen password, although it does not automatically invalidate sessions that have already been opened.
Users who leverage APIs should also monitor their key usage. An unexpected request, new consumption, or charge may indicate a leak. In this case, the old key should be deleted and a new one created, while suspicious activity should be reported to the service's support.
The indication doesn't have to be dramatic. A conversation you don't remember, a file that appeared in your history, or a change in privacy preferences can be helpful signs. The same goes for login notifications from a location or time that doesn't match your own activity.
Before deleting items, keep screenshots and note the time, device, and any charges. This information helps support determine if there has been unauthorized use. Also, avoid continuing to use the account on multiple devices, as constant new logins make it difficult to see what happened.
If the account is used for work or involves sensitive conversations, notify your organization's security officer promptly. Logging out of all sessions restricts access, but does not undo information that may have already been copied or exported.
See also: What to do if your smartphone is stolen
The key takeaway is that protection doesn't start when a big warning appears. Regularly checking active sessions, logging out of unknown devices, enabling MFA, and changing your password immediately reduce the amount of time a third party can use your account.
For those using more than one AI platform, the same process must be repeated separately for each service. This way, a suspicious event will not be treated as a simple malfunction, but as a potential breach that requires immediate disconnection and inspection.
The same caution is needed with reset emails. Do not follow links from unexpected messages and type in the service address yourself. Changing your password through a fake page can also give the attacker the new password.
