Chatgpt data leaks: are your controls keeping up?

TL;DR: ChatGPT creates three distinct risks, including sensitive input pasted into prompts, model output that can leak memorised training data, and employee trust in hallucinated answers, according to Riot, while cases at Amazon and Samsung show how quickly those risks become operational exposure. The governance gap is not awareness alone but detection, sanctioned alternatives, and explicit control over AI use.

Editorial analysis by NHI Mgmt Group, based on content published by Riot: “ChatGPT Risks in 2026: How IT Teams Can Help Employees Stay Secure”.

By the numbers:

• Google DeepMind and Cornell researchers found that repeated-word prompting could make ChatGPT leak training data 164 times more often than a neutral control word.

Key questions

Q: What breaks when employees paste sensitive data into generative AI tools without controls?

A: The control break is that data can leave the organisation outside normal exfiltration patterns, with no attachment, upload event, or obvious malware signal to catch it.

Q: Why do generative AI tools increase data security risk?

A: Generative AI tools increase risk because they expand the number of places where sensitive content can be ingested, copied, surfaced, or misused.

Q: What are the signs that shadow AI is becoming a governance problem rather than a productivity aid?

A: The clearest signs are widespread use outside IT visibility, repeated sharing of corporate data with GenAI tools, and no consistent approval path for new applications.

Practitioner guidance

• Classify promptable data before you set policy Inventory the data types most likely to be pasted into generative AI tools, including source code, contracts, PII, financial data, and M&A material, then define handling rules for each.
• Deploy AI-aware DLP and CASB controls Extend monitoring to chat interfaces and browser paste events so sensitive text can be flagged or blocked before it reaches third-party AI services.
• Turn off training-data reuse by default Verify enterprise and consumer account settings so employee prompts are not reused for model training unless the organisation has explicitly approved that behaviour.

Bottom line: Generative AI creates a three-part risk model covering sensitive input, model output leakage, and hallucination-driven misuse.

Explore further

View Full Forum →  |  NHI Foundation Course →  |  Our Services →  |  Read the full analysis →