Samsung ChatGPT leak: what did employees paste into ChatGPT, and why did Samsung ban it?

Quick answer In March 2023, less than 20 days after Samsung's semiconductor division allowed engineers to use ChatGPT, three employees pasted confidential material into it: two sets of source code and the transcript of an internal meeting. The Economist Korea reported it on March 30. On May 1, 2023, Samsung restricted generative AI tools on company devices and networks.

What did Samsung engineers paste into ChatGPT?

March 11, 2023. Samsung's Device Solutions division, the semiconductor business, lifts its block on ChatGPT. Engineers can now use it at work.¹

It takes less than 20 days for things to go wrong. Three times.¹

The first employee hits an error while running a program that downloads data from a semiconductor equipment measurement database. They want a fix. They copy the entire source code into ChatGPT and asks how to solve it.¹

The second employee has a program that identifies yield and defective equipment. They want it faster. They enter its full source code and asks ChatGPT to optimize it.¹

The third employee records an internal meeting on a smartphone, converts the recording to text with Naver's Clova app, and pastes the transcript into ChatGPT to produce meeting minutes.¹

None of them is trying to leak anything. Each is doing exactly what the new tool promised: fixing a bug, tuning code, writing up notes. And each has just sent confidential company information to servers Samsung does not control.

How did Samsung respond?

The first response was a patch. As an emergency measure, Samsung capped the amount employees could upload to ChatGPT at 1,024 bytes per question. It said it was investigating the incidents and would discipline the employees involved if necessary, and it warned that ChatGPT access on the internal network could be cut off if it happened again.¹

A month later came the ban. On Monday, May 1, 2023, Samsung sent a memo to staff at one of its biggest divisions, reported by Bloomberg's Mark Gurman. The new rules banned the use of generative AI systems on company-owned computers, tablets and phones, as well as on its internal networks.² TechCrunch reported that the restriction took effect May 1 and covered tools including ChatGPT, Microsoft's Bing and Google's Bard.³

The memo was blunt about the risk. Samsung was concerned that data sent to these AI platforms is stored on external servers, making it difficult to retrieve and delete, and could end up being disclosed to other users. An internal survey the month before found that 65% of respondents believed such services pose a security risk.²

HQ is reviewing security measures to create a secure environment for safely using generative AI to enhance employees' productivity and efficiency. However, until these measures are prepared, we are temporarily restricting the use of generative AI.

Samsung internal memo, as reported by Bloomberg

Staff who used ChatGPT on personal devices were told not to submit company-related information or personal data that could reveal intellectual property. Breaking the rules, the memo warned, could lead to "disciplinary action up to and including termination of employment." Meanwhile Samsung said it was building its own internal AI tools for translation, document summaries and software development.²

Why it happened

This was not a hack. Nobody broke in. Well-meaning engineers used a useful tool in the most natural way possible, and the tool sat outside the company.

The gap was policy and plumbing. Samsung opened access before it had controls for what could be sent. The first fix, a 1,024-byte cap, was a speed bump, not a rule about which data was allowed to leave. Bloomberg noted the company was also working on ways to block the upload of sensitive company information to external services.²

A fair caveat: there is no public report that the Samsung code later surfaced anywhere. Bloomberg said it was unclear what the leaked information encompassed.² The damage was loss of control. Once data is on someone else's servers, you cannot reliably pull it back, and that alone was enough for Samsung to hit pause.

Samsung was not alone. Bloomberg reported that earlier in 2023, banks including JPMorgan Chase, Bank of America and Citigroup had banned or restricted ChatGPT.²

What this means for your business

You are probably not guarding chip designs. But a small brand has its own crown jewels: customer lists, supplier pricing, margins, ad account access, unreleased products. Your team, and you, will paste them into a chatbot the first time it saves ten minutes.

• Decide what can leave before you hand out access. Samsung opened the door and wrote the rules afterward. Write a one-page list of data that never goes into a public AI tool.
• Prefer tools that work inside your systems. The safer setup is AI that works on your data where it already lives, with access you control, rather than staff copying it out into a chat window.
• Treat meeting recordings as sensitive. The third leak was not code. It was a conversation.
• Bans are a stopgap. Samsung itself called its restriction temporary while it built secure tools. A ban without a safe alternative leaves people tempted to use personal devices, which is why Samsung's memo had to address personal phones too.

Leaks are one failure mode. Agents that act on their own are another: see how OpenAI's Operator bought $31 eggs without asking. And if you are weighing what AI employees should do, start with what AI employees actually are.

How ZNOS handles this

In ZNOS, AI employees each own a job, such as Tanmay on growth, Raghu on ops, Sophia as executive assistant and Sundar on dev. They work from the company's live data through the Brain. You can meet the team here.

The way we run it, autonomy is earned gradually. Routine decisions are handled. Risky ones, including money, customers, anything published under your name and production changes, wait for a human approval. Content an agent drafts waits for a person before it goes out. And an Audit Log records who changed what, so when something looks off you can see exactly what happened.

Samsung's lesson is that useful AI will be used. The answer is to give the team a place to use it where the rules are already in place.