Samsung Semiconductor Trade Secret Leak via ChatGPT (2023)

Incident Summary

In March 2023, shortly after Samsung’s semiconductor division authorized the use of ChatGPT for employee work tasks, multiple engineers entered proprietary company information into the AI chatbot.^[1] In at least three documented instances, employees submitted sensitive material including semiconductor source code for a proprietary program, internal meeting notes summarizing hardware performance data, and test sequences for identifying defects in semiconductor equipment.

The data entered into ChatGPT was processed by OpenAI’s systems, meaning it was potentially incorporated into the model’s training data. At the time, ChatGPT’s default settings allowed user inputs to be used for model improvement, and once data was submitted, there was no mechanism to selectively remove it from the training pipeline. This created an effectively irrecoverable intellectual property breach.

In response, Samsung imposed a company-wide ban on all generative AI tools in May 2023, restricting employees from using ChatGPT, Google Bard, Microsoft Bing, and similar services on company devices and networks. Samsung also announced it would develop proprietary internal AI tools with appropriate data security controls. The incident became a widely cited example of the intellectual property risks posed by generative AI tools in corporate environments and prompted numerous other companies to implement similar restrictions or usage policies.^[2]

Key Facts

• Method: Employees entered proprietary data into ChatGPT during routine work tasks
• Data exposed: Semiconductor source code, internal meeting notes, hardware testing data
• Number of incidents: At least three separate instances identified
• Recovery: Submitted data cannot be selectively removed from AI training pipelines
• Corporate response: Company-wide ban on all generative AI tools
• Broader impact: Prompted multiple corporations globally to implement AI usage policies

Threat Patterns Involved

Primary: Model Inversion and Data Extraction — Proprietary data entered into a third-party AI system became potentially accessible through the model’s training process, representing an unintentional data extraction pathway.

Secondary: Overreliance and Automation Bias — Engineers used the AI tool without fully considering the data security implications of entering confidential information into a third-party system, reflecting insufficient awareness of the risks associated with generative AI tools.

Significance

1. Irrecoverable data exposure. Unlike traditional data breaches where stolen data can potentially be contained, information entered into large language model training pipelines cannot be selectively removed, creating a permanent intellectual property vulnerability.
2. Corporate AI governance catalyst. The incident prompted a global reassessment of generative AI usage policies within corporations, with many companies implementing restrictions, guidelines, or dedicated enterprise AI solutions with data protections.
3. Employee awareness gap. The engineers who entered proprietary data did so while performing legitimate work tasks, highlighting the gap between the accessibility of AI tools and employee understanding of the associated data security risks.
4. Supply chain and competitive risks. The potential exposure of semiconductor manufacturing processes raised concerns about competitive intelligence risks and the broader implications for technology supply chain security.