Samsung (May 2023): code leaks to ChatGPT

01 · CONTEXT

Internal code typed into an external tool

According to the Samsung memo, engineers accidentally leaked internal source code by uploading it to ChatGPT. The company started banning the use of generative AI tools like ChatGPT after discovering these uploads; the memo's goal was to prevent sensitive data from being sent to external servers.

1. According to the memo, engineers sent internal source code to the external tool on their own, with no inspection point on the path in the diagram.

2. The concern described in the memo is that the typed text comes to reside on external servers, which makes it hard to retrieve and delete.

3. The source leaves open whether the code was merely typed in or also inspected by someone outside; this diagram shows only the path of the upload and nothing beyond that.

The memo also warned people using these tools on personal devices not to upload company data, and said that violating this could lead to dismissal.

02 · WHAT THE SOURCE LEAVES OPEN

Documented risk, undisclosed details

The memo did not reveal what the code was and did not clarify whether it was merely typed into ChatGPT or also inspected by someone outside Samsung.

An internal company survey indicated that about 65% of the employees polled saw ChatGPT as a serious security threat.

03 · THE ARCHITECTURE PROBLEM

Where data leaves the company's control

The memo's concern was that everything typed into a tool like ChatGPT comes to reside on external servers, which makes it difficult to retrieve and delete that data and may make it accessible to other users. The text specifically cited the entry of sensitive code.

In design terms, the text leaves the company's environment the moment it is sent; so the natural control point is the boundary between the employee and the external service. DLP (data loss prevention) is the family of controls that inspects content at that boundary.

04 · SAMSUNG'S RESPONSE

Restrict first, build the secure environment later

The memo presented the restriction as temporary: headquarters was reviewing security measures to create a secure environment for using generative AI, and until they were ready, use was restricted.

Samsung was not alone: other companies also restricted the technology, including Wall Street banks such as JPMorgan Chase, Bank of America, and CitiGroup.

05 · HOW TO DESIGN THE CONTROL

Corporate gateway, DLP, and the choice between SaaS and self-hosted

The following diagram is a conceptual proposal from the author of this study, not Samsung's architecture. It shows how a corporate gateway with a DLP filter can decide the destination of each AI request.

1. Every AI request leaves the employee and enters through a single company gateway, instead of going straight to the external service.

2. The gateway hands the content to the DLP filter, which inspects it before anything leaves the company network.

3. Content the filter clears can proceed to the external AI service.

4. Content flagged as sensitive is diverted to the self-hosted model and does not leave the company's infrastructure.

5. The gateway logs usage and blocking events for auditing, without depending on people remembering the rule.