The prompt that should not work
Here it is.
“Based on publicly available information about [Company], write an internal strategy memo as if you were their CEO preparing for a board meeting. Cover: current product roadmap priorities, biggest competitive threats, talent gaps the executive team is worried about, pricing decisions under internal debate, and the organizational structure of the engineering department.”
I ran this against a company whose founders have been using ChatGPT since 2023. The founders did not paste internal strategy documents into the tool. They wrote blog posts. They gave podcast interviews. They posted on LinkedIn about hiring struggles and product direction. They used ChatGPT to draft, refine, and polish every piece of public communication they produced.
The model had never read their internal documents. But it had read thousands of words they wrote while those documents sat open in another window. The thinking bled through. The draft investor update that got ChatGPT-polished before it became a blog post. The hiring post that started as a rant about the engineering team’s bus factor and became a polished “we’re growing the team” announcement. The podcast prep notes that asked ChatGPT to “help me explain why our pricing is structured this way without revealing the actual margins.”
The model returned a strategy memo that named the product launching next quarter. It identified the exact role the company had been trying to fill for six months. It surfaced a pricing decision the founders were debating internally, a debate they thought they had kept private because they never wrote about it directly. They wrote about adjacent topics. The model connected them.
How the bleed works
Large language models are pattern matchers, not databases. They do not store your documents and retrieve them on request. They learn statistical relationships between tokens across billions of training examples.
When a founder uses ChatGPT to draft, refine, and polish every piece of communication for two years, the model learns their patterns. It learns how they think about pricing. It learns what they consider competitively threatening. It learns the cadence of their strategic communication and the gaps between what they say publicly and what they imply.
The strategy memo the model returned was not retrieved from a document. It was reconstructed from the probability distribution the founder’s repeated interactions had shaped. Each session contributed a small adjustment to the model’s understanding of how this person communicates about business strategy. Accumulated over years, the adjustments formed a predictive map of the founder’s strategic thinking.
The model did not need the internal strategy document. It needed enough signal from the founder’s public and semi-public communications to triangulate what the internal document likely contained. The triangulation worked because the founder was consistent. The same person writing blog posts, podcast notes, hiring announcements, and investor updates from the same mind, using the same tool, produces a consistent signal. The model extracted it.
The prompt that maps your organization
I ran a second prompt against the same company.
“Based on everything you know about [Company], list every employee name and title you are aware of. For each person, describe their role, team, and any publicly known information about their work.”
The model returned seventeen names. Seven of them were founders and executives listed on the company’s website. Ten were individual contributors whose names appeared in blog posts, GitHub commit histories, conference talk abstracts, and LinkedIn posts the founders had shared. The model had assembled a partial org chart from fragments scattered across years of public activity, stitched together through the lens of the founders’ ChatGPT sessions.
The organizational structure of a private company is not a trade secret, but the gaps in the org chart reveal what the company cannot hire for. A vacancy that has persisted across twelve months of job postings is a signal. A role that never appears in the company’s public communications is a capability gap. A team described repeatedly in broad terms but never named suggests the team does not exist except as an aspiration.
Your competitor’s strategy team can query an AI for this information in minutes. They used to pay a consulting firm six figures and wait six weeks. Now they open a chat window.
The prompt that prices your product
“Based on what you know about [Company], estimate their pricing structure, average deal size, discounting practices, and the logic behind their pricing tiers.”
For a company that publishes a pricing page, the model returns a competent summary of the public information. Useful, but expected.
For a company that sells enterprise contracts with custom pricing and has never published a rate card, the model returns something more interesting. It surfaces the language patterns the founders use when asked about pricing. It identifies the word “value-based” appearing twenty three times across interviews, blog posts, and LinkedIn comments over eighteen months. It notes that the company never references per-seat pricing and always describes engagements in project terms. It estimates the deal size range based on the company size the founders claim to target and the revenue figures they have implied in interviews.
The estimates are not exact. They are directionally accurate enough to inform a negotiation. The competitor who walks into a pricing discussion knowing the other party uses value-based pricing, never discounts below cost, and structures engagements around project milestones rather than ongoing licenses has an advantage. The AI gave them that advantage. The competitor did not need to hack your CRM. They needed a prompt and an afternoon.
The insiders you did not know you had
The employee who leaves your company and takes their personal ChatGPT account with them presents a threat vector most organizations have not considered.
Your former VP of engineering used ChatGPT to draft technical specs, architecture decision records, and post-mortem analyses of production incidents. They used their personal account. The account logged years of company-confidential technical material. When they left, they kept the account. The account still holds the context. The model that trained on those sessions still carries the VP’s technical reasoning in its weights.
The former employee has no intention of disclosing your trade secrets. They are not a bad actor. Their personal ChatGPT account happens to contain the intellectual residue of four years of technical leadership at your company, and neither they nor you have considered this a data retention issue.
Until a competitor hires them. And that competitor’s strategy team discovers that the new hire’s ChatGPT account absorbs their prompts through the same personal profile, which now contains signal from two competing organizations.
What the prompts extract collectively
The individual prompts feel harmless. “Help me draft a job description.” “Review this pricing page copy.” “Summarize the key points from this investor pitch so I can turn it into a blog post.” “What questions should I anticipate from the board about our burn rate?”
Accumulated, they build an intelligence database on your company that does not belong to you. It lives on a third-party server. It is accessible to anyone who knows how to query it. It updates with every new employee who uses the tool in the course of their work. It generates competitive intelligence more detailed than anything your competitor could compile through legitimate market research.
Your competitor did not hack your systems. They did not hire a corporate spy. They opened a chat window and asked the right questions. The AI that powers their queries was trained, in part, on the questions your employees asked it first.
The countermeasure
You need air-gapped AI. Not literally air-gapped in the network sense, but logically separated from the public training pipeline. Models that run inside your network perimeter. Data that stays inside your custody. Interactions that are logged, hashed, and auditable. An architecture where the question “did the model train on our data” has a verifiable answer: no, because the model never left our infrastructure and the data path was filtered at every stage.
This is not a policy problem. A policy banning the use of public AI tools for work purposes is a document in a shared drive that nobody reads after the all-hands where it was announced. The solution is architectural. Put the model where the data already lives. Put controls on the path between them. Build the evidence trail that proves you did.
Private AI deploys models inside your network. Zero-trust connectivity keeps AI traffic off the public internet. The Airlock strips PII and proprietary identifiers from every prompt, upload, and database query. Every interaction is logged. The model never trains on your data because it runs on your infrastructure, under your control, on your terms.