AI platforms add account activity logs to detect unauthorised access

AI platforms have introduced account activity logs to help users detect unauthorised access. ChatGPT and Perplexity display active sessions, allowing users to log out of unfamiliar devices. Claude also lists sessions but does not use passwords, instead sending login links via email. This design choice removes the need for password resets but limits recovery options if an attacker gains access to the linked email account.

The tools provided are reactive rather than proactive. Users must manually check for suspicious sessions, as none of the platforms send alerts for unauthorised logins. ChatGPT and Perplexity require password resets after logging out of all sessions, while Claude’s password-free system means users can only revoke access by terminating all active sessions. This approach shifts the burden of detection onto the user.

Multi-factor authentication (MFA) is available on ChatGPT and Perplexity, reducing the risk of password-based breaches. Claude’s reliance on email links for authentication eliminates passwords but introduces a single point of failure if the email account is compromised. Engineers using these platforms for sensitive work should enable MFA where possible and regularly audit active sessions to mitigate risks.

The lack of automated alerts for suspicious logins means users must proactively monitor their accounts. While terminating sessions is straightforward, recovering full control requires additional steps, such as password resets or re-authentication via email. Teams integrating these platforms into workflows should document account recovery procedures to minimise downtime after a suspected breach.