Samsung's ChatGPT Leak — How Employees' Prompts Led to a Generative AI Ban

In spring 2023 Samsung Electronics became the standard example of a new corporate risk: confidential information leaving the company not through a hack, but through employees typing it into a chatbot. On 30 March 2023 the Korean business weekly Economist (이코노미스트) reported that, within 20 days of Samsung's semiconductor division allowing staff to use ChatGPT, engineers had pasted proprietary source code and a meeting transcript into it. On 2 May 2023 Bloomberg reported an internal memo in which Samsung barred the use of generative AI tools such as ChatGPT on company devices and internal networks.

Samsung did not invent the worry — major US banks had already restricted ChatGPT — but its case supplied the concrete incident that the risk had lacked, and other companies, Apple among them, followed with restrictions of their own within weeks.

The three incidents

According to the Economist Korea report by Jung Du-yong, Samsung had blocked ChatGPT at work over leak concerns, then on 11 March 2023 allowed its Device Solutions (DS) division — the semiconductor business — to use it, while the Device eXperience (DX) division, covering mobile and consumer electronics, kept the ban. Less than 20 days later, the company had counted three incidents.

Samsung classed two as equipment-information leaks and one as a meeting-content leak. The report's concern was that material sent to OpenAI could be reviewed by its staff and used as training data, so it could not be recalled once submitted. Samsung's emergency response, according to the report, was to cap each question at 1,024 bytes, investigate the employees involved with possible disciplinary action, warn that ChatGPT could be blocked on the internal network if it happened again, and consider building its own AI service. A Samsung official declined to confirm the incidents, citing internal matters.

The ban

On 2 May 2023 Bloomberg reported, having reviewed the memo, that Samsung was restricting generative AI on company-issued computers, tablets and phones and on non-company devices connected to its internal networks. TechCrunch and Korea's News1 summarised the memo: the restriction was described as temporary, until security measures were in place; staff using such tools elsewhere were told not to enter company-related information or personal data; consumer devices Samsung sells were not affected. The stated reason was that data sent to these platforms is stored on external servers, where it is hard to retrieve and delete and could be disclosed to other users. According to TechCrunch, an internal survey Samsung ran in April found that about 65% of respondents saw generative AI as a security risk.

Reports differ on timing: the Korean Economist placed the leaks in March, while some coverage of the May ban described the source-code upload as happening in April. The Economist Korea report, published on 30 March, is the earliest account.

A wave of restrictions

The Apple case shows the reasoning spreading to code assistants. According to 9to5Mac's summary of the Wall Street Journal report, Apple's document barred GitHub Copilot, Microsoft's AI coding tool, as well as ChatGPT, out of concern that confidential data could leak to the developers of these tools; the report also noted a March 2023 ChatGPT bug that had exposed other users' chat histories. TechCrunch noted that in South Korea, LG and SK Hynix were also reported to be working out their own generative-AI guidelines.

The vendors' answer

The restrictions created a market. When OpenAI launched ChatGPT Enterprise on 28 August 2023, TechCrunch reported its central promise: OpenAI would not train models on business data sent to the enterprise product or on usage data, and conversations were encrypted in transit and at rest. TechCrunch explicitly tied that emphasis to businesses that had restricted employees from using the consumer version. Samsung went the other way. On 8 November 2023 it unveiled Samsung Gauss, a family of language, code and image models built by Samsung Research and already in internal use by employees, including a coding assistant called code.i, with the models able to run on-device.

Who carried the risk

For employees, the episode moved the line between a productivity shortcut and a disciplinary matter. The engineers in the Economist report were doing ordinary work — debugging code, writing up a meeting — with a tool their division had just approved, and according to the report faced investigation and possible discipline. The 1,024-byte cap and then the device ban put the burden of managing the risk on staff, who were told what not to type rather than given a safer tool, until Samsung's own models arrived.

For companies, the risk Samsung's memo named was about where data goes, not about how capable the AI was: once source code or a meeting transcript reaches a third party's servers, it is hard to retrieve or delete. The products that followed answered that concern directly. ChatGPT Enterprise was sold on a contractual promise about training data, and Samsung, which could afford to, built models it controlled.

The Samsung case and the Arup deepfake video-call scam of 2024 are two early, concrete forms of AI risk that companies had to manage: one where information leaks out through employees' prompts, the other where fabricated people talk money out of employees.

See also the cybersecurity timeline and, for a public-sector parallel the same year, New York City schools' ChatGPT ban.