OpenAI active sessions now show device, app, location, sign-in time, and trusted status; use this AI product team hygiene checklist. Read now.
What Active Sessions Surface Now
OpenAI active sessions list the signals that matter for account hygiene: device, app, location, sign-in time, and trusted status. Treat that list as a live inventory of every client still holding access to your workspace—not a one-time audit screen. Device and app tell you whether a session belongs to a known laptop, phone, or desktop client versus something you never installed. Location and sign-in time help you spot logins that do not match travel patterns or work hours. Trusted status is the binary you use to decide keep versus revoke: if you did not deliberately trust a device, assume it should not stay trusted.
Review the full list whenever someone joins or leaves the team, after a password or SSO change, and after any suspected phishing or shared-device use. A short, recurring check beats a long annual cleanup that never happens.
Hygiene Checklist for AI Product Teams
Product, research, and ops teams often share ChatGPT under team or org accounts while pasting proprietary prompts, code, and customer context. Session hygiene is access control for that material. Use this checklist as a standing practice, not a one-off ticket.
- Map every active session to a known person, device, and app; revoke anything unmatched.
- Clear sessions on personal phones, shared conference machines, and old laptops after demos or travel.
- Revoke sessions immediately when contractors finish, laptops are reimaged, or credentials are rotated.
- Prefer work-managed devices for anything marked trusted; avoid “trusted” on public or borrowed hardware.
- After a revoke, confirm the user can still sign in on their current device and that stale entries are gone.
Assign one owner—security, IT, or a tech lead—to run the review on a fixed cadence and to act on reports of “I see a session that is not mine.” Ownership prevents the list from becoming everyone’s problem and no one’s job.
How to Decide Keep, Distrust, or Revoke
Walk each row with three questions: Is the device familiar? Does the app match how the person works? Do location and sign-in time fit normal use? If any answer is no, revoke rather than wait for a better explanation. Trusted status should be rare and intentional—reserved for stable, personal work devices—not applied to every successful login. When in doubt, revoke and re-authenticate; the cost is a re-login, not a silent shared session.
Do not rely on memory alone. Compare the session list against your asset inventory and known travel. Shared accounts and “just this once” logins on a colleague’s machine are common sources of mystery sessions; end those sessions as soon as the task ends.
Make It Stick in Team Process
Document where to open active sessions, who may revoke, and how to escalate a suspicious entry. Fold the check into offboarding, laptop return, and post-incident playbooks so it is not optional. Remind people not to leave ChatGPT signed in on shared browsers, and to sign out or revoke after using a kiosk, hotel machine, or borrowed tablet.
Active sessions turn account security into something you can see and act on: device, app, location, sign-in time, and trusted status. Use them as a short cheat sheet for ongoing hygiene—review, match, distrust when unsure, revoke aggressively—so team access stays limited to people and devices you still intend to trust.