Data leakage through assistant prompts

Samsung Electronics, March 2023: less than three weeks after allowing ChatGPT, its semiconductor division found three leaks, source code pasted in to fix errors and the recording of an internal meeting. On May 1, the group blocked generative tools on company computers. An employee who pastes a piece of source code, a contract or a client file into a consumer chat assistant hands that data to a third party. The terms of use of these services sometimes allow the provider to keep it and use it to improve the service. The incident is defined by what it lacks: no intrusion, no exploited vulnerability, no malicious act. No perimeter security device sees it go by, since it is outbound traffic to a legitimate service. Legally, though, it is a personal data breach whenever the information falls within scope, with the notification duty that comes with it. In other cases it is a disclosure of trade secrets. The broader problem, teams using unapproved services on their own initiative, does not yield to a ban: a ban pushes usage onto personal devices, where it becomes invisible. What works is offering an acceptable alternative and logging outbound traffic.