ChatGPT's new AI file search needs a permissions check

ChatGPT Business can now read a file the moment its account is connected, whether that account lives in Google Drive, Dropbox, Box, or SharePoint. OpenAI turned on the wider connectors on September 10, 2026, alongside a Data plugin that builds dashboards from a plain question and a Deep research mode that turns a multi-source dig into a cited document. For a small business already paying for the plan, that is real capability. It also means anyone with access to that ChatGPT workspace can now surface anything sitting across those drives, including the folder nobody meant to leave open.

What actually shipped this week

• File search across Google Drive, Dropbox, Box, and SharePoint from one chat, no reupload required
• A Data plugin that turns a typed question into a dashboard or report from connected sources
• Deep research available in ChatGPT Work and Codex, producing a cited, editable document
• All of it lives on the ChatGPT Business and Enterprise plans, priced around $25 per user monthly or $20 annually, not on personal ChatGPT Plus accounts

Why AI file search changes the risk math

None of this is a new hole in Dropbox, Box, or SharePoint. Each system still enforces its own sharing rules. What changed is the aggregation point. A loose share that used to stay contained to one system, invisible unless someone went looking, is now reachable from a single chat window that searches four storage systems at once. In practice that means the usual suspects show up first: an HR folder shared to the whole team drive because it was easier at the time, a client contract with a link set to anyone who has it, a financials export left in an old project's shared Dropbox, a former contractor's SharePoint access nobody revoked. None of that is exotic. It is the ordinary debris of running a small business on shared drives for a few years, and it is exactly what a connected AI search finds first, because it is built to answer a plain-language business question.

1. 1

   Pull a sharing report from each connected drive

   Google Drive, Dropbox, Box, and SharePoint each have an admin view that lists who has access to what. Export it before you connect anything, not after.

2. 2

   Close out stale shares

   Revoke access for former employees and contractors, and turn off any link set to anyone with the link rather than named people.

3. 3

   Segment the sensitive folders

   Move HR files, contracts, and financials into a smaller team drive or restricted library with a short member list, separate from general project files.

4. 4

   Turn on connectors seat by seat

   Enable the file connectors for the ChatGPT workspace seats that actually need cross-drive search, not the entire team by default.

5. 5

   Re-run the sharing report in thirty days

   Confirm the cleanup held and nobody quietly reopened a folder while working around the new restrictions.

Where this earns its keep

Once the access is cleaned up, the actual use case is a good one. A monthly operations review that used to mean pulling a scheduling export from SharePoint, a client list from Dropbox, and notes from Drive, then stitching them together by hand, can now go to Deep research as a single question and come back as an editable document with sources attached. That is hours back for an owner or office manager, on a plan a lot of small service businesses already pay for. The tool works fine on its own. An access list nobody has checked in two years is the actual risk, and it was the risk before this update too. This just made it searchable.

If your files are already split across three or four of these systems and you want a second set of eyes on the access map before you turn the connectors on, bring me your setup and we will look at it together.