This is a research prototype. The data and analyses are preliminary and not yet validated — we'd welcome your .
Samsung engineers inadvertently leaked sensitive company data, including proprietary source code and internal meeting notes, by inputting the information into ChatGPT for task assistance. Because ChatGPT retains user inputs for model training, this confidential information was transferred to OpenAI's servers. The incident prompted Samsung to restrict employee use of external AI tools and develop an in-house alternative.
Samsung engineers are reported to have inadvertently leaked sensitive company data sometime in March 2023, including source code and internal meeting notes, by using ChatGPT to assist with tasks. The AI retained the inputted data, leading to a breach of confidentiality.
Domain classification, causal taxonomy, severity scores, and national security assessments were LLM-classified and may contain errors.
AI systems that memorize and leak sensitive personal data or infer private information about individuals without their consent. Unexpected or unauthorized sharing of data and information can compromise user expectation of privacy, assist identity theft, or cause loss of confidential intellectual property.
Also classified as
Employees overrelied on ChatGPT to perform work tasks involving highly sensitive proprietary data without considering the system's data retention policies.
The incident involved the unauthorized transfer and potential exposure of Samsung's proprietary source code and internal meeting notes to OpenAI's servers through ChatGPT.
Human
Due to a decision or action made by humans
Unintentional
Due to an unexpected outcome from pursuing a goal
Post-deployment
Occurring after the AI model has been trained and deployed
The data leak was caused by human employees unintentionally inputting confidential trade secrets into ChatGPT after its deployment.
Samsung semiconductor engineers inadvertently leaked proprietary source code and chip-testing data to OpenAI servers via ChatGPT. Because semiconductors are a highly strategic technology for South Korea, this exposure represents a substantial threat to technological and economic security, highlighting new vectors for intellectual property exfiltration via generative AI.
The report describes ChatGPT being used to 'help them with tasks' such as fixing source code, optimizing test sequences, and converting meeting notes into a presentation. This fits the Assistant profile as it augments human capabilities and requires human input and oversight.
Limited Risk: The system involved is ChatGPT, which is explicitly classified as a chatbot. Under the EU AI Act, chatbots are subject to transparency obligations to ensure users are aware they are interacting with AI.
ChatGPT was utilized by Samsung engineers as a writing and coding assistant to optimize chip testing sequences, fix source code, and summarize meeting notes.
The report clearly outlines the nature of the incident, the specific AI system used (ChatGPT), the developer (OpenAI), the affected party (Samsung), and the exact mechanism of the data leak (data retention for training). There is minimal ambiguity regarding what transpired.
None. The event is straightforwardly a corporate data leak via an external AI tool.
Technology
AI Data Retention Policy
ChatGPT retains user input data to further train its models.
Irretrievable Data Storage
Data sent to OpenAI servers cannot be retrieved or deleted.
Lack of In-House AI Tools
No secure in-house AI alternative was available for employees.
Data Inputs
Confidential Source Code Input
Engineers inputted proprietary source code to fix program bugs.
Sensitive Meeting Notes Upload
Employee uploaded confidential meeting notes to generate a presentation.
Proprietary Test Sequences Shared
Employee shared confidential chip fault optimization sequences with ChatGPT.
Human Factors
Lack of Employee Awareness
Workers unwittingly leaked top secret data without realizing risks.
Desire for Task Optimization
Employees prioritized work efficiency over data security protocols.
Overreliance on AI Assistants
Workers trusted external AI tools with sensitive proprietary tasks.
Process and Methods
Absence of AI Usage Guidelines
No clear processes existed for using external AI tools safely.
Lack of Input Monitoring
No mechanism was in place to block confidential data uploads to AI.
Management
Delayed Risk Assessment
Management failed to assess risks of generative AI before adoption.
Lack of Proactive AI Policies
Samsung reacted to leaks with warnings instead of proactive controls.
Regulatory Environment
Inadequate AI Data Regulation
Lack of enforced compliance regarding data deletion rights in AI.
GDPR Non-Compliance
AI service lacks features to respect core tenets like data deletion.
AI system involved
Identified by automated extraction; can differ from the alleged developers above.
