Your AI account was hacked: how to tell, and what to do first

Conversations in your history that you did not have — a different language, a subject you have no interest in, a coding question from someone who does not code. A charge or a plan change you did not make. A sign-in code emailed to you while you were doing something else entirely. A session listed on a device or in a country that is not yours. A model usage or rate limit you hit without using it. Any one of these on its own is enough to go and check the device list; none of them is worth waiting to confirm with a second sign, because the account is doing whatever it is doing in the meantime.

The dominant way these accounts change hands has nothing to do with a break-in at OpenAI, Anthropic or Google. It is information-stealing malware, picked up from a cracked download, a fake installer or a malicious browser extension, which reads every password stored in the browser and copies the session cookies sitting beside them, then packages the lot for sale. Chat logins have become a routine line item in those bundles because the accounts carry paid subscriptions. The practical consequence is the whole reason the order below matters: a stolen session cookie lets somebody stay signed in as you regardless of how good your new password is.

Scan the computer or phone you use for the service and remove anything it finds, before touching a password — otherwise the new one is captured as you type it. Then reset the password, using something you have not used anywhere else. Then sign out of all devices, which is the step that kills the attacker’s existing session and the one most people skip. Then turn on two-factor authentication, and save the recovery codes offline. Finally secure the email address behind the account, because on most of these services a password reset is just an email away and the inbox is the real key. Reversing any two of those steps means starting again in a week.

Assume every conversation was read. The job now is to turn that into a list: any password, API key, account number, address, client name or document you ever pasted into a chat needs rotating or watching, and the list is longer than anybody expects because a chat window does not feel like a place where you are typing secrets. Work through it before you clear the history, because once the threads are gone so is your record of what was in them. Then delete what you would not want quoted back at you, and consider turning off training on your conversations while you are in settings.

For anyone who has ever opened the developer side of these platforms, this is where a hijacked account stops being an inconvenience. An API key is a bearer credential: whoever holds it can spend against your account until you revoke it, and usage-based billing means the damage keeps growing quietly rather than showing up as a single charge. Revoke and regenerate every key rather than only the ones you think were exposed, set a spending limit, and check the usage graph for a period that does not match your own work. Do the same for the consumer side — look at the subscription, the payment method on file and any plan upgrade you did not buy.

Modern AI accounts reach outwards: connectors and integrations to your files, your calendar, your repositories, your mail. Those connections outlive a password change and are the quietest way to keep reading someone’s data after being locked out of the front door. Go through the connected-apps or integrations list and remove anything you do not actively use, then do the same on the Google, Microsoft or Discord account behind the service. While you are in the mail settings, look specifically at forwarding rules and filters — the same quiet persistence trick shows up after every kind of account takeover.