The secret code pasted into a chatbot

In March 2023, Samsung's semiconductor division allowed engineers to use ChatGPT. Within about a month, media reported three incidents in which staff entered confidential material.

According to those reports, one engineer pasted source code to find a bug, another asked it to improve test sequences used to find faults in chips, and a third asked it to turn meeting notes into a presentation. Samsung reportedly warned staff that data sent this way could not be retrieved.

In May 2023, Samsung temporarily restricted the use of ChatGPT and similar tools on company devices and networks, while it worked on safer options. In an internal survey, about 65% of staff who responded said these tools carry security risks.

When you type into a public chatbot, your words travel to the provider's servers. Depending on the service and its settings, they may be stored, reviewed or used to improve future models. You cannot take them back.

The engineers were not careless people. Pasting code into a helpful tool feels like using a calculator. The risk is invisible at the moment you press Enter.

The idea behind this caseLesson: What not to paste into AI →

1. 1Write a one-page rule that lists what must never go into public AI tools: source code, customer data, contracts, unreleased plans.
2. 2Provide an approved business AI tool with data protection terms, so people have a safe option.
3. 3Teach staff to remove names, numbers and secrets, or to describe the problem in general terms.
4. 4Check the data settings of any AI tool your team uses, including whether chats are used for training.
5. 5Make it easy and blame-free to report a mistake, so leaks are handled quickly.