Samsung employees leak source code and meeting notes via ChatGPT
Date: 2023-04
Affected: Samsung Semiconductor — internal source code, meeting notes, hardware schematics
Attack vector: insider
Category: real-world
Severity: High

Multiple Samsung semiconductor engineers pasted confidential source code, internal meeting transcripts, and hardware design schematics into ChatGPT for debugging and summarisation assistance. OpenAI's data handling policy at the time allowed submitted content to be used for model training. Samsung discovered the leaks internally and banned ChatGPT use within weeks. Three separate incidents were reported in under a month.

Impact: Potential training data contamination with trade secrets; regulatory risk under South Korean data protection law; organisational response: enterprise ChatGPT ban

Mitigations:
Data Loss Prevention (DLP) at network egress blocking AI API endpoints
Acceptable use policy for AI tools with training and enforcement
Enterprise AI gateway with content classification before forwarding to external APIs
Shadow AI risk register (DSGAI03) to identify unauthorised AI service usage

Architectural layers (MAESTRO):
label: Foundation Models
notes: Model may incorporate confidential content into training signal
role: impact
label: Data Operations
notes: Confidential data submitted as model input without data governance controls
role: origin
label: Security & Compliance
notes: No DLP or egress controls on AI API usage; no acceptable use policy enforced
role: blind-spot