Detects ChatGPT Enterprise Codex prompts or responses that contain credential-like patterns. The rule scans OpenAI ChatGPT Enterprise Codex logs for strings that resemble access keys, tokens, private keys, or other secret material in both the prompt_text and the response_text fields. It intentionally excludes clearly synthetic examples (e.g., AKIAIOSFODNN7EXAMPLE, ghp_example) but flags matches that align with common credential formats (AKIA/ASIA keys, GitHub tokens, private keys, xox tokens, OAuth-like patterns, and other known secret patterns). When a live secret is detected, it recommends immediate containment actions (rotate/revoke credentials) and review of related Codex tool activity; it also suggests restricting access to compliance logs that may contain secret material. The rule supports triage with contextual fields (session, user, prompt/response text, client_id) and provides investigation steps. It is mapped to credential-access techniques in MITRE ATT&CK and MITRE ATLAS, reflecting potential credential exposure risk within Codex interactions. The rule is intended to operate within the OpenAI ChatGPT Enterprise integration environment and requires compliance logs to be ingested into Elasticsearch. It includes defined false-positive considerations (e.g., developer debugging content) and remediation guidance (credential rotation, log review, and access restrictions).