Samsung restricts staff use of generative AI after sensitive data reached ChatGPT

Samsung Electronics began temporarily restricting employee use of generative AI tools such as ChatGPT on company devices on 1 May 2023, after internal data had been entered into the chatbot. Samsung confirmed the restriction to reporters on 2 May 2023, the same day Bloomberg reported that some staff had uploaded sensitive code to ChatGPT.

What happened

Samsung had allowed employees in its device solutions division, which runs its semiconductor and display businesses, to use generative AI tools. According to TechCrunch, internal and sensitive company data was later leaked to ChatGPT in April. Staff in one of the largest divisions were told of the new restriction in a memo at the end of April, which cited cases of misuse of the technology.

Impact

The volume and exact nature of the data that reached ChatGPT have not been published by Samsung. TechCrunch reported that Samsung flagged two concerns: data sent to external AI servers is hard to retrieve and delete, and it could be disclosed to other users. In an internal Samsung survey conducted in April, 65% of respondents said they were concerned about security risks from generative AI services.

Response

The restriction covered company-owned computers, tablets and phones, plus personal devices connected to internal networks. Employees were also told not to enter personal or company information into these services when using them outside work. A Samsung spokesperson said the limit would stay until the company had measures in place for safe use, and CNBC reported that Samsung was looking for ways to use generative AI safely.

Lessons for security leaders

Once source code or business data is pasted into a public chatbot, the organization has no practical way to pull it back. Publish an acceptable-use rule for generative AI before rollout rather than after an incident, and pair it with an approved tool that keeps prompts inside a contract you control. Data loss prevention coverage should extend to browser traffic bound for AI services, and staff training should give concrete examples of what must never be pasted into a prompt.