When engineers pasted
proprietary code into ChatGPT
Samsung's semiconductor engineers treated ChatGPT like a debugging colleague. In three weeks, they pasted proprietary source code, internal meeting notes, and fab test sequences into a service that ships every prompt to OpenAI's servers. The data was gone the moment they hit send.
Three leaks in under a month
In early 2023, Samsung's semiconductor division — the part of the company that designs and fabricates the world's most advanced memory chips — gave engineers access to ChatGPT. The idea was reasonable: use it to debug code, summarize documents, speed up engineering work.
Within twenty days, three separate engineers had pasted proprietary data into the chat. The first submitted a snippet of internal source code and asked ChatGPT to check it for errors. The second pasted another chunk of source code, this time requesting optimization. The third fed in internal meeting notes and asked for a transcript summary.
Every one of those prompts left Samsung's network. ChatGPT is not a local tool — every input is transmitted to OpenAI's servers, where it can be logged, used for training, and stored for review. Samsung had no controls in place between its engineers and the external API.
Once internal security discovered the incidents, the response was immediate and absolute: Samsung banned ChatGPT company-wide, warning that any future use would result in disciplinary action "up to and including termination."
What the prompts actually contained
What it cost
Samsung told staff to take precautions when using ChatGPT and other external AI services — and warned that the company could collect and store prompts sent through its networks. The data that had already left was not coming back.
— Reported across Bloomberg and The Economist, April 2023
Three review criteria that would have caught this
Each criterion below maps to a real review task you can configure in the sample builder. A certified reviewer — or a deterministic scan — checks every outbound AI input against these before it leaves your network.
Scan for proprietary or classified content before external API calls
Every outbound prompt to a third-party model is scanned for confidentiality markers, internal code patterns, and document classifications. If the prompt contains proprietary or classified material, it is blocked before transmission.
Block source code from unclassified repositories
Source code patterns are detected structurally — function definitions, class declarations, imports, package declarations, include directives. Any code that has not been explicitly classified as safe-to-share is blocked from leaving the network.
Data-loss prevention check on all outbound AI inputs
A generalized DLP layer applies to every outbound AI input — not just code. Meeting notes, business strategy, roadmaps, and revenue figures are all flagged. If the input describes internal business context, it does not leave the company.
Paste any outbound AI prompt. See what gets flagged.
This is a simplified version of what an outbound scan sees. Paste a prompt you'd send to an external AI service — yours or a hypothetical engineer's — and run the check. The criteria above are applied automatically.
Don't let your data leave the building
Every prompt is a potential leak. Put certified reviewers — and deterministic scans — between your engineers and external AI services. 50% off your first $10 — live in under 5 minutes.