Samsung and the source code uploaded to ChatGPT

What happened?

In early 2023, Samsung allowed engineers in its semiconductor division to use ChatGPT to help fix source-code errors. By April 2023, the company discovered that engineers had inadvertently put internal source code, a trade secret, into ChatGPT to check for technical errors.

In early May 2023, according to an internal notice reported by Bloomberg, Samsung banned employees from using generative AI tools on company-issued computers, tablets and phones and on the internal network. Employees using personal devices were also told not to enter company information or data that would expose intellectual property; violations were subject to discipline up to termination of employment.

Why was the ban introduced?

Data sent to an AI service sits on external servers, is very hard to retrieve or delete, and may be shown to other users.
An earlier internal Samsung survey showed that 65% of respondents considered generative AI a security risk.
The company made clear this was a temporary measure while it developed internal AI tools and looked for ways to block company data from being uploaded to external services.

Lessons for enterprises

The risk comes from well-meaning people. The engineers just wanted to work faster: no attacker was needed.
A total ban is only a stopgap. The need to use AI remains; enterprises need to specify clearly which data may go into AI and which is prohibited.
Policy must come with technical controls. Written rules do not stop the action of pasting data into a chat window.

A data-centric approach

With documents and source code protected on the file itself, the enterprise determines who may open them, whether copying is allowed, and records access logs. Clipboard Isolation blocks copy-paste of confidential content into public AI tools. Enterprises should divide data into three zones (AI allowed, AI restricted, confidential data not for AI) and then apply policy per zone. See also the product and How AI increases the risk of data leakage.

Three questions for a self-check

Which AI tools are your employees using, and with what kinds of data?
Can confidential documents be copied and pasted off the machine?
When data has already leaked, do you have logs to know who did it and when?

Reference sources

The content is compiled from public sources at the time of writing, for reference and lessons learned only. It is not a legal assessment of any organization named. Please check the original sources when citing.