Samsung Engineers Pasted Secret Code into ChatGPT
On this page
No exploit, no vulnerability — just employees handing trade secrets to a third-party model, one paste at a time.
| When | April 2023 |
|---|---|
| Target | Samsung Electronics (semiconductor division) |
| Data sent to | ChatGPT / OpenAI |
| Cause | Employees entering proprietary data into a third-party LLM |
| Response | Company-wide ban on generative-AI tools |
- 1Engineers turn to ChatGPT to debug code and summarise a meeting
- 2They paste confidential source code and an internal transcript into the prompt
- 3The trade-secret data leaves the corporate trust boundary onto a third-party's servers
What happened
Within about three weeks in April 2023, Samsung semiconductor engineers pasted confidential company data into ChatGPT on at least three occasions — reportedly proprietary source code and the transcript of an internal meeting. On 1–2 May 2023, Samsung notified staff via an internal memo that it was restricting generative-AI tools on company devices and networks, explicitly citing the difficulty of retrieving or deleting data once it is sent to external servers.
How it happened
There was no attacker and no flaw in ChatGPT. Employees reached for a convenient tool and, in doing so, moved trade-secret data outside the company's control — where it may be retained by the provider and is no longer governed by Samsung's policies.
Root cause
“Shadow AI”: a powerful third-party tool adopted informally, with no policy, no controls, and no sanctioned internal alternative — so confidential data flowed into it.
What a review would have caught
A data-flow review of how staff actually use AI tools — and DLP telemetry on paste/upload to external AI services — surfaces this pattern before a leak, rather than after.
How to prevent it
- Set a clear acceptable-use policy for AI tools and train staff on it.
- Apply DLP to paste/upload into external AI services.
- Offer a sanctioned internal option so people don't take secrets to consumer tools.
FAQ
Was ChatGPT at fault?
No — this is a data-governance failure, not a product vulnerability. Employees voluntarily entered confidential data into a third-party LLM, where it leaves the company's control and may be retained or surfaced elsewhere.
Why is it a security incident?
Because the sensitive data left the trust boundary. Once proprietary code sits on an external provider's servers it is hard to retrieve or delete — the essence of an LLM02 disclosure.
How do organisations prevent it?
Clear acceptable-use policy, DLP on paste/upload to AI tools, and a sanctioned internal option so staff don't reach for consumer tools with company secrets.