Detects OpenAI ChatGPT Enterprise audit events that publish a GPT or update sharing for GPTs, skills, or projects (gpt_publish, update_sharing, skill_share, project_update_sharing). The rule ingests data from the OpenAI ChatGPT Enterprise integration into Elasticsearch and returns key identifiers such as @timestamp, event action, user info, source IP, and relevant action_data fields (gpt_id, agent_id, skill_id) along with sharing scope data (shared_to.recipient_type). The primary risk is exposure of proprietary instructions, connectors, or agent configurations when sharing scope broadens beyond the intended audience. It maps to exfiltration-oriented techniques and triggers investigations when share scope appears wider than policy allows or when publishing occurs outside approved change management. Setup requires the OpenAI ChatGPT Enterprise integration to collect compliance logs. The rule associates a moderate risk score (47) and medium severity, with MITRE mappings to ATT&CK T1567 Exfiltration Over Web Service and ATLAS AML.T0025 Exfiltration via Cyber Means. Investigations should identify the actor and the GPT, skill, or project identifiers, review recipient_type and related share fields, verify whether the change aligns with change management, and look for related publish or share events from the same actor. Remediation includes restricting unauthorized shares, unpublishing if needed, and inventorying other assets by the same actor. False positives occur when teams publish for approved internal or partner use under change management. References include Elastic OpenAI ChatGPT Enterprise docs and OpenAI compliance guidance.