Companies are leaking their own secrets to AI tools without realizing it. Employees feed sensitive data into ChatGPT and similar models, which can then reproduce that information in responses to other users. Preventing this requires company-wide data governance, not just security teams.
Chapters
If someone's attacking you and stealing things, then that's one thing. But if it's kind of an unforced error where you are actively leaking your own trade secrets to the world, that's a real, like, that's a proper own goal. That's a really terrible thing. In terms of stopping this, does it start with the security teams or do you need to be like a C-suite that do this? Like, who needs to solve this problem?
I think it's a company-wide effort given how everyone in the company is using these tools. I think a lot of it starts with data governance. Even if you have someone that is not malicious internally, they might be sending data that they shouldn't. Like they pulled a bit of customer data because it's so easy to go pull that and they shared it with another model. And your policies for your company say, hey, we don't share customer data like this. And now it's in someone else's model and maybe they're training on that and it can get reproduced in some other way. I think this isn't just kind of nefarious people from the outside or nefarious people on the inside. People just don't realize how much data AI is constantly scraping up and how much these integrations are kind of pulling pulling in all these data sources.