Someone Else Might Be Reading Your ChatGPT History

Over 100,000 stolen AI chatbot logins are already circulating on dark web marketplaces. Here's exactly where to check yours.

Welcome Back,

Just like any other online service, hackers can target and break into your accounts on popular AI platforms such as ChatGPT, Claude, and Perplexity, according to TechCrunch's Lorenzo Franceschi-Bicchierai. It's an obvious point once you hear it, and an easy one to overlook, most of us think about account security for banking and email, far less for the AI chatbot we've been pasting years of personal and professional context into.

That risk isn't hypothetical. A separate report cited by Technology Org found 101,134 infected devices holding saved chatbot logins circulating on dark web marketplaces, with volume peaking at 26,802 in a single month. Criminals have clearly worked out the value of these accounts.

Today we look at the exact, step-by-step way to check for suspicious logins on ChatGPT, Claude, and Perplexity, why Claude's login system works completely differently from the other two, and why the email inbox behind all of these accounts might be the single most important thing to secure first.

🔍 ChatGPT: Check Your Active Sessions First

To find out if someone has broken into your ChatGPT account, open it on your computer's browser, click on your username in the bottom left corner, go to "Settings," then "Security and Login," and finally click on "Active Sessions." You'll see every device currently logged into your account, if anything looks unfamiliar, you can log out of that single device, or click "Log out all" to clear everything at once.

If you want to change your password after that, you'll need to log out of your account first. On ChatGPT's website, click "Log in" in the bottom-left corner, enter your email address, click "Forgot password," then "Continue." ChatGPT will send you an email containing a six-digit code, enter that code on the login page, click "Continue," and then set a new password.

That MFA distinction matters, ChatGPT and Perplexity support multi-factor authentication, meaning even a stolen password alone isn't enough to get in if you've turned that extra layer on. Take a moment to check your ChatGPT security settings for that option if you haven't already enabled it.

ChatGPT's "Active Sessions" page shows every device currently signed into your account.

🔑 Claude: The Platform With No Password to Steal

Claude's approach is genuinely different from ChatGPT's. To check it, open Claude in your computer's browser, click your username in the bottom-left corner, then "Settings," and click "Account." That's where you'll find your "Active sessions." If you don't recognize one of them, hover over it, click the three vertical dots that appear on the right, and click "Log out" or "Terminate." You can also click "Log out of all devices" to clear everything at once.

That doesn't make Claude immune to compromise, though, it just shifts the attack surface entirely onto your email inbox. If someone can access the email address tied to your Claude account, they can request that same login link themselves. Which brings us to the part of this story that matters more than any single platform's settings menu.

🕵️ Perplexity: The Platform That Shows You Nothing

Perplexity handles this differently than either of the other two, and honestly, less transparently. The AI-powered search engine does not show you where you are logged in, there's no list of active devices to review at all.

So if you're worried someone may have broken into your account, go to Perplexity in your browser and click your username in the bottom-left corner, then "All settings." Finally, click on "Sign out of all sessions," and then "Confirm." At that point, you can log back in by entering your email address, you'll then receive an email with a unique six-digit code. Enter the code on the website to log in, or click the "Sign in" button in the email to log in directly.

Perplexity's blanket sign-out is a blunt tool, since it can't show you which specific devices are logged in beforehand.

📧 Your Inbox Is the Real Front Door

Every one of these recovery flows, ChatGPT's six-digit code, Claude's login link, Perplexity's six-digit code, lands in the same place, your email inbox. That makes the mailbox attached to these accounts the single most valuable target in the entire chain.

That's a genuinely important reframe. It's tempting to think of "checking if my ChatGPT account was hacked" as an isolated task specific to that one app. In practice, it's downstream of a much more fundamental question, is my email account itself secure, since anyone who controls that inbox can reset or log into essentially every AI platform tied to it.

The baseline advice holds regardless of platform, use a different, unique password for every service, store them in a password manager, and turn on multi-factor authentication wherever it's offered. The industry is gradually moving toward passwordless sign-in built on device-bound credentials, which removes the reusable secret entirely, but most AI platforms, and most of the internet generally, haven't fully arrived there yet.

✅ The Five-Minute Checklist

Pulling this together into something you can actually act on right now, before you finish reading this newsletter.

None of these steps require technical expertise, and none take more than a couple of minutes per platform. That's genuinely the whole point, this isn't a task that needs to be scary or complicated, it's a habit worth building the same way you'd periodically check your bank statement.

Multi-factor authentication on your email account is the single highest-leverage step, since it protects every downstream recovery flow.

🧠 AI Spotlight Analysis

The most useful thing about this story is how ordinary it treats AI accounts, exactly like any other online service, subject to the exact same hygiene practices as your bank or your email. That framing is a genuinely healthy corrective to how casually a lot of people, understandably, treat AI chatbots as low-stakes tools rather than accounts holding years of personal conversations, work drafts, and sensitive context.

Claude's no-password design is a small but genuinely interesting glimpse of where account security is generally headed, removing the reusable secret that gets phished, leaked, or reused across sites. It's not a complete solution on its own, since it just relocates the trust to your email, but it does eliminate one specific, very common attack vector entirely.

That plainly stated fact is really the whole story. AI platforms have quietly become another category of account worth genuinely protecting, right alongside email and banking, and the good news is the actual defensive steps are quick, specific, and already sitting inside settings menus you've probably never opened.

🔗 Sources and Further Reading

Thanks for reading AI Spotlight.

Our mission is simple: deliver clear, trustworthy, and actionable AI insights that help professionals stay ahead without the hype.