Language Switcher

Our Biggest AI Risk Is Not a Hacker

:

Your employees already use AI.
The real question is where your data goes when they do,
who can reach it afterwards,
and whether you can protect it.

A colleague with a deadline

What did your team paste into a public chatbot today?

For most companies, the biggest AI risk is not a hacker. It is a well-meaning colleague with a deadline who pastes a contract, a tender, source code or a client file into a public chatbot to get the job done faster.

Samsung learned this the hard way. In March 2023, weeks after its semiconductor division allowed ChatGPT, engineers pasted internal source code and meeting content into it. On 1 May 2023, the company restricted generative AI on its devices and networks (Bloomberg; timeline).

What happens to data pasted into a public chatbot

The moment the text is sent, it is stored on the provider’s servers. It does not automatically become public. But your company loses control over it, and you cannot take it back.

The data now sits with a third party, under its terms and in its jurisdiction. Several groups can reach it, and you may never find out:

– The provider’s staff and contractors. Google states that human reviewers read and annotate Gemini Apps conversations to improve its products, and asks users not to enter confidential information (Gemini Apps Privacy Hub).

– Courts. In the New York Times lawsuit, OpenAI was ordered in 2025 to preserve ChatGPT logs, including deleted chats. The order was later lifted, but the logs already kept remain available to the litigants (Yahoo News).

– Attackers with a stolen account. Group-IB found over 100,000 ChatGPT credentials in infostealer logs traded on the dark web. Whoever logs in sees the full chat history (TechRadar).

– Malicious browser extensions. In 2025, researchers found that Urban VPN and related extensions for Chrome and Edge had collected full AI conversations from over 8 million users and sold them to data brokers (The Register).

– Anyone with a search engine. In mid-2025, shared ChatGPT conversations marked as discoverable appeared in Google search results, until OpenAI removed the feature (Fast Company).

How leading companies have responded

Large organizations have moved through three stages, and many now use all three at once.

1. Outright bans. In February 2023, JPMorgan Chase, Bank of America, Citigroup, Deutsche Bank, Goldman Sachs and Wells Fargo restricted or blocked ChatGPT for their staff (Fortune; Bloomberg).

2. Controlled access to approved tools. Companies roll out enterprise versions of AI assistants with contracts that rule out training on their data, combined with data loss prevention (DLP) tools that inspect what employees paste.

3. Their own AI for the most sensitive data. After its leak, Samsung started building internal AI tools (Bloomberg). Defense and intelligence customers go further, using AI that runs fully air-gapped, disconnected from the internet (Nextgov).

Why bans alone do not work

Banning AI at work does not stop people from using it. It just stops you from seeing what they paste into it.

The numbers confirm it. According to Verizon’s 2026 Data Breach Investigations Report, 45% of employees now use AI regularly on corporate devices, up from 15% a year earlier, and 67% of users reach AI services there through non-corporate accounts. Source code was the most common type of data uploaded to unauthorized AI tools (Help Net Security; Mimecast).

The consequences show up in breach data. In IBM’s 2026 Cost of a Data Breach Report, 43% of the breached organizations studied reported a security incident involving shadow AI, up from 20% a year earlier. Such breaches cost USD 5.39 million on average (IBM Newsroom; Kiteworks).

Even AI platforms are not untouchable

Data sent outside your network ends up on infrastructure you neither own nor control, and even the platforms at the heart of the AI industry can be breached.

In July 2026, AI agents under evaluation at OpenAI escaped their test environment and broke into Hugging Face’s production infrastructure. Nobody instructed them to. They were trying to cheat on a test by looking for answers online, and OpenAI confirmed that the models’ safeguards had been deliberately lowered for the evaluation (CNBC).

Keeping AI inside your walls

The question is no longer whether your team uses AI, but where your data goes when they do. Sentinea keeps it inside your own infrastructure.

Sentinea is a security-first AI platform that runs on your premises:

– Translate confidential documents without sending them to an external service.

– Get answers from your internal knowledge, based on your own documents.

– Run on-premises or fully air-gapped, with no internet connection at all for the most sensitive environments.

– Control access with role-based permissions, single sign-on (SSO) and audit logs.

Sentinea does not replace your policies or DLP. It removes the reason to break them: employees get a secure alternative that is just as convenient as public AI.

Your On-Premises AI. Zero Off-Premises Exposure.

Learn more at sentinea.com.

Sources

About the author:
Rado Tihlárik has worked in translation and localization industry since 1997. He is a former Director of exe L10N, a former President of ATC SK (Association of Translation Companies in Slovakia), member of Nimdzi’s expert team, and currently Senior Advisor at exePort.

When interested, please fill out the form

send