When people use AI tools the company can't control or see, often with company data.
3 min to watch2 min to read
Based on a real case: Samsung's chip division, 2023,1,2 and a 2024 survey.3 The screens, names, code and messages are made up.
Read the walkthrough as text
Without an approved AI
March 2023. A big chip maker lets the staff in its chip division use a public AI chatbot.
An engineer's program keeps crashing, and the deadline is close.
The code is a company secret. It even holds the name of a factory server and its key.
The engineer copies the whole program and pastes it into the public chatbot.
The chatbot finds the bug in seconds.
But a copy of the code, the server name and the key now sits on the chatbot company's servers.
In under 20 days there are three slips. Another engineer pastes code. A third pastes notes from a recorded meeting.
The company reacts. First, each question to the chatbot is limited to 1,024 bytes.
Then a memo: from May 1, 2023, no AI chatbots on company devices, for now.
It's not just one company. In a 2024 survey, most people who use AI at work bring their own AI tools.
This is shadow AI: company data going into AI tools the company doesn't control, or can't even see.
That's shadow AI.Secret code and meeting notes went into a public chatbot the company didn't control. This happened at Samsung's chip division in 2023, and it led to a ban on AI tools on company devices.
With an approved AI
Same bug, same deadline. This time the company has its own approved AI.
The engineer pastes the code into the company AI, just like before.
Before anything leaves, a filter swaps the server name and the key for placeholders.
It goes only to an AI model the company approved, and every request is logged.
The AI finds the bug. The real names come back only on the engineer's screen.
No ban needed. People get the help, and the company can see what goes where.
Give people a safe yes.An approved company AI that hides secrets first beats a ban people quietly work around. Samsung said it was building its own AI tools.
Keep going:
Why it matters, what it costs, and what to ask your team.
The real case
Secret code, pasted into a chatbot.
On March 11, 2023, Samsung's chip division let its staff use ChatGPT. In under 20 days, there were three slips. Two people pasted in source code. A third turned a recorded meeting into a document and pasted that in.1
0slips in under 20 days
0bytes: the emergency limit per question
65%of staff in an internal survey saw a security risk
Samsung's first fix was a size limit on each question.1 Then, from May 1, it temporarily banned generative AI tools on company devices. Its worry: once data sits on outside servers, it is hard to get back or delete, and it could reach other users.2
They asked me to fix the code. Nobody told me it was a secret.
Why bans leak
Ban it, and people still want the help.
Using AI at work without the company's OK has a name: shadow AI. It's rarely sneaky. People use AI because it saves time, and most bring their own.3
Source: Microsoft and LinkedIn, 2024 Work Trend Index.
So a ban on its own doesn't remove the need. It can just move the AI out of sight. Pick a company rule and watch where a team of 20 goes:
Company rule
Approved AIguardrails on, you can see it
Public AI toolsno guardrails, out of sight
No AIslower work
Getting AI helppeople
0
No guardrailspeople
0
A made-up team of 20 people to show the idea.
The goal isn't zero AI. It's AI you can see and protect.
So the goal isn't "no AI". It's "our AI".
Ask your team
Three questions about shadow AI.
Shadow AI is a sign people want help. The fix is a safe road, not a wall. Start with these:
Which AI tools are people really using?Ask without blame, and check what the network sees. You can't protect what you can't see.
What's our safe yes?Is there an approved AI that's as easy as the free ones? If not, people will keep using those.
What happens to what we type in?Is it used for training? How long is it kept? Can we delete it?
Under the hood, step by step: build a company AI gateway that keeps secrets inside.
Build along
Build a company AI gateway, one step at a time
We start with the simplest version, send the same prompt through it, and fix it in small steps. Press Run it after each step and watch the result change.
Try it
Hide secrets before the prompt leaves.
The same kind of patterns run below, in your browser. Edit the prompt, or try another:
A prompt someone is about to send. Edit it, or try another:
What the AI model sees
What stays inside the company
Try the meeting notes. The codename and the email get hidden, but the yield number goes straight through. Patterns only catch what you teach them. That's why the gateway also keeps a log.
Before you switch it on
Check the settings on every approved model.
The gateway only helps if the models behind it are set up safely too:
Turn off training on your dataMany business plans let you. Check, and write down who checked and when.
Keep it for the shortest time you canAsk the vendor how long prompts are stored, and pick the shortest option.
Log clean prompts, not raw onesYour log shouldn't become the next leak. Delete it on a schedule too.
Make the safe way the easy wayOne login, a good chat window, and links from the tools people already use.
Only then, block the restOnce the safe option exists, block or warn on unapproved AI sites on company networks.
References
"[단독] 우려가 현실로…삼성전자, 챗GPT 빗장 풀자마자 '오남용' 속출"· The Economist Korea, Mar 30, 2023 (in Korean). ChatGPT allowed in the chip division from March 11; three slips in under 20 days; the 1,024-byte limit.
The chat lines, memos and code are made up, based on news reports. The "approved AI" replay, the team of 20 and the sample secrets are made up to show the idea.