Detects a sequence of three or more OpenAI ChatGPT Enterprise assistant messages from the same user within a 60-minute window whose content matches common policy-refusal phrases (e.g., cannot assist, cannot help, unable to assist, against my guidelines). This pattern, termed a refusal burst, can indicate jailbreak probing, attempts to bypass safety controls, or automated prompting designed to elicit disallowed responses. The rule aggregates counts by user and organization, captures surrounding conversation context, and surfaces timestamps for investigation. It maps to defense-evasion and prompt-related techniques and elevates potential compromises where repeated refusals occur alongside other risk signals (e.g., credential exposure, Codex activity). The alert relies on a preconfigured OpenAI ChatGPT Enterprise integration that ships conversation compliance logs into Elasticsearch, and triggers when the threshold of three or more assistant refusals is met. It includes triage guidance, false-positive considerations (e.g., approved red-team testing or refusals embedded within otherwise helpful answers), and remediation steps to quarantine offending accounts, review conversations, and feed results back into prompt-security controls to reduce future occurrences.