Detects potential data exfiltration via Google Drive when used through an OpenAI ChatGPT Enterprise Drive connector. The rule watches app_log events from the OpenAI ChatGPT Enterprise integration for Google Drive requests and extracts two fields from the flattened input: download_raw_file and url. It aggregates by user.email and a one-hour time bucket, counting distinct Drive download URLs where download_raw_file is true. If five or more distinct URLs are downloaded within the hour, an alert is produced. The alert includes the user, time bucket, download_count, the list of download_url_values, and the first/last seen timestamps. This pattern—rapid bulk retrieval of cloud files via a chat-integrated Drive connector—is indicative of staging bulk data for exfiltration after session compromise. False positives include approved bulk exports in migrations, eDiscovery, or research work. The rule maps to MITRE ATT&CK techniques Exfiltration (T1567) and Data from Information Repositories (T1213); MITRE ATLAS mappings include AML.T0053 AI Agent Tool Invocation and AML.T0025 Exfiltration via Cyber Means. The rule is labeled medium severity with risk score 47. It requires the OpenAI ChatGPT Enterprise integration to collect app_log data for Google Drive (request logs with input.download_raw_file and input.url). Investigation steps emphasize correlating with sensitive Drive searches, Gmail discovery, or unusual authentication activity, and validating whether the Drive connector usage was authorized. Remediation includes revoking the Drive connector if unauthorized and hunting for follow-on shares or Gmail/Social forwarding from the same user. Setup notes specify the need for Google Drive request logs and flattened input fields in the integration data stream.