These are real incidents, not scare tactics. Samsung engineers leaked semiconductor source code through ChatGPT. OpenAI had a bug that exposed payment info for 1.2% of Plus subscribers. The big AI companies all log conversations and use them for training by default. I compiled the worst offenders here so you don't have to dig through news articles yourself.
The Samsung Incident
The short version: Samsung engineers pasted proprietary source code into ChatGPT. It became part of OpenAI's training data. Samsung banned the tool company-wide.
In April 2023, Samsung engineers pasted proprietary semiconductor source code into ChatGPT to debug it. They also pasted confidential meeting notes. This sensitive data became part of OpenAI's training data. Samsung banned ChatGPT internally after the incident.
What gets me about this is it wasn't a hack. These were engineers doing exactly what the tool was designed for. The problem is the tool logs everything by default.
ChatGPT Data Breach (March 2023)
The short version: A bug in ChatGPT's library let some users see other people's chat titles and payment info. About 1.2% of Plus subscribers were affected.
OpenAI disclosed a bug in ChatGPT's open-source library that allowed some users to see titles from other users' chat histories. About 1.2% of ChatGPT Plus subscribers had their payment information exposed (name, email, last four digits of credit card). The incident was contained, but it proved that even major AI companies have security vulnerabilities.
The Training Data Problem
AI models are trained on massive datasets. For large language models, that includes books, websites, forums, and code repositories, often without the original creators' consent. When you use GPT-4, you're using a system built on other people's work.
The reverse is also true: your conversations can become training data. OpenAI, Google, and Anthropic all use user conversations to improve their models unless you specifically opt out. And even with opt-out, data retention policies vary.
Data Retention Policies Compared
| Company | Retention | Training Use | Opt-Out |
|---|---|---|---|
| OpenAI | 30 days (even with opt-out) | Default on | Yes (settings) |
| Google (Gemini) | Up to 3 years | Default on | Yes (activity controls) |
| Anthropic (Claude) | 30 days | Possible | Limited |
| NanoGPT | None | Never | N/A (no logging) |
Legal Risks
Several legal cases have raised questions about AI and data privacy:
- Attorney-client privilege: Bar associations in multiple US states have warned lawyers about using AI tools that log conversations with confidential case information. Some firms have started banning AI tools entirely.
- HIPAA compliance: Healthcare providers who paste patient data into ChatGPT may be violating HIPAA regulations. I've heard of clinics that still haven't updated their policies on this.
- GDPR implications: European regulators have questioned whether OpenAI's data practices comply with GDPR. Italy temporarily banned ChatGPT in 2023 over privacy concerns.
How to Protect Yourself
The short version: Use privacy-first tools like NanoGPT or Ollama, never paste sensitive data into mainstream AI, and opt out of training data in your settings.
Use privacy-first tools
Pick AI services with zero-logging policies. NanoGPT, DuckDuckGo AI Chat, and self-hosted options like Ollama are solid choices.
Never paste sensitive data into mainstream AI
Assume everything you type into ChatGPT, Claude, or Gemini is logged and could be used for training. Treat it like posting on a public forum.
Opt out of training data
If you must use mainstream AI, go into settings and disable conversation history and training data usage. It's not perfect, but it helps.
Use separate accounts
Don't link your AI usage to accounts with your real name, workplace, or other identifying information.
Self-host for maximum privacy
For truly sensitive work, run AI locally with Ollama or Jan.ai. Your data never leaves your machine. I do this for anything I wouldn't want in a database.