They leaked trade secrets by accident

March 2023. Samsung lifted its ChatGPT ban.

Three weeks later, semiconductor source code showed up in OpenAI's training data.

Here's what happened:

Incident 1: An engineer pasted buggy code into ChatGPT to find the error. The code included proprietary database architecture details.

Incident 2: Another engineer uploaded equipment testing sequences to optimize them. Trade secrets.

Incident 3: A third engineer transcribed a meeting and asked ChatGPT to generate minutes. Internal strategy discussions included.

All three employees were trying to work faster. None of them were being reckless. They were using the tool exactly as intended.

The problem: the tool worked exactly as designed. It learned from everything they gave it.

Here's why this keeps security leaders up at night:

Traditional security assumes you can detect and stop unauthorized access. Someone tries to download sensitive files? Alert. Someone accesses a system they shouldn't? Alert. Unusual data transfer? Alert.

With AI, there's no alert. The employee has legitimate access to the data. They're using an approved device. They're doing their job. Nothing triggers your monitoring systems.

The breach happens in plain sight, and you can't see it.

And once the AI learns from that data, you can't undo it. Your proprietary code is now permanently part of the model's training data. You can't delete it. You can't revoke access to it. You can't get it back.

When a competitor asks that AI model for coding best practices in your industry? The response might include patterns learned from your code.

The gap traditional security can't fill:

You can't block AI tools. Employees will use them on personal devices.

You can't monitor AI usage. Most of it happens outside your network.

You can't rely on employee judgment. "Don't paste sensitive data" fails when employees decide what counts as sensitive in the moment.

What actually works:

Understand how different AI tools handle data. Training vs. RAG vs. fine-tuning makes a massive difference in risk.

Provide approved AI tools with proper data isolation. If you don't give employees safe options, they'll use unsafe ones.

Build clear policies about what data never goes into AI tools. Not vague "use good judgment" rules, but specific lists.

Train people on what happens to data in AI systems. Not scare tactics, actual technical explanations.

If you want to learn how to secure AI systems when traditional controls don't work:

AAISM is the first certification focused entirely on AI security management. It covers how to assess AI tools for data handling risks, build governance frameworks for AI usage, and implement security controls designed for systems that learn from user input.

Our next AAISM Bootcamp runs May 11-13, 2026. Three days with Joseph Zefrani covering everything ISACA tests. You get a full year of access to all course materials, plus four implementation tools for real-world AI security work.

Enroll before April 19 and save $300.

Learn more and enroll

Stay secure,
The DestCert Team