Samsung did it. Twice.
In April 2023, Samsung engineers pasted proprietary source code into ChatGPT to debug a semiconductor manufacturing process. The chip fabrication code represented years of R&D. It contained trade secrets governed by Korean IP law. ChatGPT ingested it. OpenAI’s training pipeline processed it before Samsung’s legal team knew what happened.
One month later, another Samsung employee uploaded an internal meeting transcript to ChatGPT and asked the model to summarize the notes. The transcript covered product launch strategy, pricing tiers, market positioning, and a competitive vulnerability assessment against TSMC.
Samsung banned ChatGPT internally. Every employee received a memo. The ban lasted three months. Then Samsung deployed their own internal AI tool because the productivity loss from the ban exceeded the risk of continuing without one.
Banning AI does not work. Staff go back to their phones. You just pushed the leak outside your network perimeter, where you cannot log it, cannot audit it, and cannot prove it happened when a regulator asks.
The Apple engineer and the confidential specs
Apple employees operate under some of the strictest information security policies in the tech industry. Apple’s culture around secrecy is legendary. Teams work in physically isolated buildings. Prototypes travel in locked cases.
In mid-2023, an Apple software engineer asked ChatGPT to review documentation for an unreleased feature. The documentation described a forthcoming API that had not been announced to developers. It included method signatures, data models, and the internal code name for the project.
The engineer’s intent was efficiency. Reviewing internal docs takes hours. ChatGPT returns feedback in seconds. The tradeoff in the engineer’s mind was time saved versus a remote possibility of exposure. The remote possibility materialized.
Apple banned ChatGPT across internal networks. The ban extended to GitHub Copilot, which Apple also restricted, citing concerns about code suggestions derived from Apple’s proprietary repositories flowing through Microsoft’s servers.
Two of the most valuable companies on earth, with security budgets larger than most national governments, could not prevent their employees from pasting confidential material into an AI chatbot. Your firm will not either.
The pharmaceutical researcher and the clinical trial
A researcher at a mid-sized European pharmaceutical company uploaded anonymized clinical trial data to ChatGPT in late 2023. The prompt asked the model to identify patterns in adverse event reports across treatment arms. The data was de-identified per protocol. The researcher assumed that made it safe.
De-identified data is not anonymous data. Patient records stripped of names can be re-identified with three external data points: date of birth, gender, and postal code. Latanya Sweeney demonstrated this in 1997. The technique has only become easier with public datasets, social media, and data brokers selling consumer profiles by the billion.
The researcher uploaded 2,400 patient records. Each record contained the de-identified fields plus treatment arm assignment, adverse event codes, dosage information, and therapy duration. The dataset represented three years of clinical research and tens of millions of euros in trial costs.
HIPAA considers de-identified data outside its scope. GDPR considers it still personal if re-identification is possible. The regulator in the researcher’s country has not ruled on whether uploading clinical trial data to a US-based AI service constitutes a cross-border data transfer requiring a Data Protection Impact Assessment. The researcher’s employer is waiting to find out.
”Write a competitive analysis of my company”
Here is a prompt that extracts more than you think:
“Based on everything you know about [Company X], write a detailed competitive analysis. Include their business model, pricing structure, target customers, key differentiators, organizational structure, recent strategic moves, known vulnerabilities, and any internal tensions or disagreements that are publicly documented.”
Replace [Company X] with a publicly traded company and you get a well-informed analysis drawn from earnings calls, press releases, Glassdoor reviews, and news coverage. Useful, but surface-level.
Replace it with a private company where the founder has been using ChatGPT to draft board decks, investor updates, internal strategy memos, and hiring plans for two years. The model has not read any of those documents directly. But it has read every document the company’s employees created while augmented by the tool. The founder’s writing patterns, strategic instincts, revenue figures mentioned in passing, and competitive anxieties flow through every output.
Now write the same prompt as the founder of that company’s closest competitor. The model knows your business model. It knows your pricing structure. It knows the anxiety points you mention in private conversations. It assembled this knowledge across thousands of sessions with employees who thought each individual interaction was harmless.
The model will not tell you it has this knowledge. But the response to that competitive analysis prompt will reveal it, line by line.
The data you cannot claw back
OpenAI allows users to opt out of training data usage. The setting lives behind an account-level toggle. If you toggle it today, conversations after today will not be used for training. Conversations before today were used already. The training run that ingested them completed months ago. The weights containing your data are deployed across every ChatGPT instance globally.
You cannot delete your data from a model. You can delete your account. The account deletion removes your chat history from OpenAI’s active systems. It does not un-train the model. It does not extract your intellectual property from the weights. The concept of “un-training” a large language model does not exist outside of research papers that demonstrate it is theoretically possible and practically infeasible.
Once an employee pastes a pricing spreadsheet into a public chatbot, the data enters the model’s training distribution. If a competitor receives a suspiciously well-informed competitive analysis from the same model six months later, you cannot prove the connection. You cannot depose the model. You cannot subpoena the training set. You can only add the cost to your risk register and hope the damage was contained.
What regulators will ask you
South Africa’s Information Regulator has not issued guidance on AI training data. The UK Information Commissioner’s Office has published a consultation. The EU AI Act classifies AI systems by risk tier and imposes transparency obligations on providers, not on users who paste data into them.
But POPIA Section 19 requires you to secure the integrity and confidentiality of personal information. Section 20 requires you to notify the Regulator and the data subject of a security compromise. Uploading a CRM export to a public AI service to “find some insights” ticks both boxes.
The Regulator will not care that it was “just one employee” or that they used a personal account on a personal device. The data left your custody. You are the responsible party. Your policies failed.
What stops this
Banning ChatGPT and Claude solves the problem for a week. Your staff find alternatives. Open-source models run on consumer laptops. Mobile apps with nice interfaces wrap the same APIs. The ban does not eliminate the behaviour. It eliminates your ability to see it.
The alternative is containment. Give your people AI that stays inside your network. That logs every interaction. That strips PII and proprietary identifiers before anything reaches a language model. That lets you prove, to a regulator, that the AI did not see what it should not have seen.
Because the question is not whether your employees paste sensitive data into AI tools. They do. Right now. The question is whether you can prove it did not leave your custody when someone asks.
Private AI deploys models inside your network with zero-trust connectivity and automatic PII redaction. Every interaction is logged. Every path is filtered. Your data stays your data. Not someone else’s training set.