At Samsung, employees accidentally leaked sensitive company code through ChatGPT, prompting a temporary ban on generative AI tools across the organization, according to Reuters. Companies are imposing strict bans on external AI tools to prevent data leaks, but this inadvertently pushes employees to use personal, unmonitored AI accounts for work, increasing the risk of shadow IT, according to Shadow IT Report. A recent Gartner survey found 43% of companies are considering or have already restricted generative AI use. This means companies are trading perceived immediate security for long-term innovation and control; without clear, secure internal alternatives, the risk of data exposure through shadow AI is likely to increase. This approach can transform defensive measures into offensive liabilities.
The Growing List of Companies Saying 'No' to Public AI
Major players are restricting public AI use:
- JPMorgan Chase has restricted employee use of ChatGPT, citing concerns over proprietary data leakage, according to Bloomberg.
- Apple has reportedly banned employees from using ChatGPT and other external AI tools, fearing intellectual property theft, according to Wall Street Journal.
- Amazon has warned employees against sharing confidential information with AI chatbots, even for internal tools, according to an Internal Memo.
These actions by finance and technology giants underscore a broad industry concern: public AI models pose a significant risk to sensitive data and intellectual property.
Why the Ban: Data Leaks, IP Theft, and Regulatory Fears
Inputting company data into public AI models risks violating data privacy regulations like GDPR, according to Legal Review, leading to significant penalties and reputational damage. This concern is amplified by the rising financial cost of breaches: the average data breach in 2023 cost $4.45 million, a 15% increase over three years, according to IBM Security.
These combined legal and financial risks compel stringent corporate AI policies. However, as the Samsung incident shows, companies attempting to control AI through prohibition often trade visible risks for unmanageable, invisible threats, making data breaches more likely, not less.
