Topic starter
23/10/2026 12:47 am
TL;DR: ChatGPT creates a three-part risk pattern around pasted sensitive input, memorised output and hallucinated answers, according to Riot. AI use needs detection, sanctioned alternatives and explicit training-data settings to keep that pattern from becoming exposure.
Editorial analysis by NHI Mgmt Group, based on content published by Riot: “ChatGPT Risks in 2026: How IT Teams Can Help Employees Stay Secure”.
By the numbers:
- Google DeepMind and Cornell researchers found that repeated-word prompting could make ChatGPT leak training data 164 times more often than a neutral control word.
Key questions
Q: Why do generative AI tools increase data security risk?
A: Generative AI tools increase risk because they expand the number of places where sensitive content can be ingested, copied, surfaced, or misused.
Q: What are the signs that shadow AI is becoming a governance problem rather than a productivity aid?
A: The clearest signs are widespread use outside IT visibility, repeated sharing of corporate data with GenAI tools, and no consistent approval path for new applications.
Q: What breaks when employees paste sensitive data into generative AI tools without controls?
A: The control break is that data can leave the organisation outside normal exfiltration patterns, with no attachment, upload event, or obvious malware signal to catch it.
Practitioner guidance
- Classify promptable data before you set policy Inventory the data types most likely to be pasted into generative AI tools, including source code, contracts, PII, financial data, and M&A material, then define handling rules for each.
- Deploy AI-aware DLP and CASB controls Extend monitoring to chat interfaces and browser paste events so sensitive text can be flagged or blocked before it reaches third-party AI services.
- Turn off training-data reuse by default Verify enterprise and consumer account settings so employee prompts are not reused for model training unless the organisation has explicitly approved that behaviour.
Bottom line: Generative AI creates a three-part risk model covering sensitive input, model output leakage, and hallucination-driven misuse.
Glossary terms: Shadow AI, Input Risk, Effect Risk, Hallucination Risk
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 6 days ago by NHI Mgmt Group
23/10/2026 9:49 am
ChatGPT risk is now a data-governance problem, not just an acceptable-use problem. The article shows that employees do not need malicious intent to create exposure, because paste-based workflows let sensitive material cross the trust boundary instantly. In practice, this means AI use policy must be tied to detection, approved alternatives, and data classification if it is to be enforceable.
A few things that frame the scale:
- 43% of security professionals are concerned about AI systems learning and reproducing sensitive information patterns from codebases, according to the State of Secrets in AppSec.
A question worth separating out:
Q: When should organisations restrict ChatGPT use instead of allowing it broadly?
A: They should restrict it whenever the workflow involves sensitive data, regulated records, source code, or operational instructions that could cause harm if exposed or misused. Broad approval works only when the organisation can classify inputs, govern outputs, and enforce acceptable-use rules consistently across teams.
👉 Read our full editorial: Chatgpt data leaks expose the gap between policy and control
This post was modified 6 days ago by NHI Mgmt Group