Samsung and the Source Code That Walked Into ChatGPT

In early 2023, Samsung’s semiconductor division allowed engineers to use ChatGPT to help with their work. Within about twenty days, the tool had been handed company secrets three separate times.

One engineer pasted in source code from an internal semiconductor database to get help fixing an error. Another submitted code for measuring equipment yield and defects, asking for optimization. A third recorded an internal meeting, turned the audio into text, and fed the transcript to ChatGPT to produce minutes. Every one of these was a reasonable thing to want help with, and every one sent confidential material to a service that, by design, retains what users type and may use it to improve the model.

Samsung banned generative AI tools on company devices and began building an internal alternative. But the code and the meeting were already gone. You cannot unpaste.

Where it failed

There is no clever bug here and no rogue actor. The engineers were trying to do their jobs faster, with a tool the company had just allowed. ChatGPT behaved exactly as advertised. That is what makes this a governance failure rather than a technology one.

The break was in people and process. Staff were given access to a powerful external service with no clear line about what could and could not go into it, and no sanctioned, private place to get the same help. When the safe path does not exist, people take the fast one. The outcome was certain the moment the door was opened without a rule on it.

ChatGPT did exactly what it was built to do. That is what made this a governance problem rather than a technical one.

How it could have been caught

The controls are mundane and they work. Decide, in plain terms, what categories of information may never be pasted into an external AI tool, and tell people why. Provide an approved, private channel, an enterprise tool under a contract that says the data is not retained or trained on, so the helpful capability is available without the leak. And where the stakes justify it, add technical checks that catch source code or flagged data on its way out. The goal is to make the safe path the easy one, because the easy path is the one people take.

What it means for AI

Samsung is now every organization’s situation. Staff have access to capable AI tools whether or not the company has decided how to handle them, and the tools are most useful precisely when fed real, sensitive work. This is shadow AI, and the data-governance question it raises is not new. It is just faster and quieter than it used to be.

None of the remedies are complicated. Whatever goes into an AI service should be treated the way you treat any data leaving your control, because that is what it is. Write the rule before the leak rather than after one, and give people a sanctioned way to get the benefit without it. The failure mode here was never misuse by bad actors. It was ordinary people using a permitted tool exactly as intended.