Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Employees are feeding sensitive data to ChatGPT, raising security fears

darkreading.com

Post reply on HN
Print view View original

161–170 of 355 posts

Re: Employees are feeding sensitive data to ChatGPT, raising security fears

#161

Post by Thorentis »

wantsanagent wrote: post #78

We saw these same fears with the release of Gmail. Why would you trust your email to Google?!! Aren't they going to train their spam filters on all your data? Aren't they going to sell it, or use it to sell you ads? Corporations constantly put their most sensitive data in 3rd party tools. The executive in the article was probably copying his company strategy from Google docs. Yes, there are good reasons for concern,…

> too profitable to not participate in

Sorry, but I really struggle to see how a non AI company will actually become more profitable simply by getting their employees to use ChatGPT. In fact, the more companies that use it, the more demand there will be for "human only" services.

Re: Employees are feeding sensitive data to ChatGPT, raising security fears

#162

Post by WhereIsTheTruth »

That's why privacy is important in the real world

Imagine if everyone knew your inner secrets just by looking at you at the bar..

Why is it different online? i have no idea.. well i kinda know but.. oh well.. we deserve it i guess

Re: Employees are feeding sensitive data to ChatGPT, raising security fears

#163

Post by acomjean »

tedunangst wrote: post #138
nostromo wrote: post #131

Earlier quoted context omitted.

Does blocking ever work? People are smart and usually just work around them.

Blocks are effective reminders of policies.

I remember someone trying to look up winning lottery numbers at work. The site came up "Blocked: Gambling". It was a little reminder that they're watching our web browsing at work..

Re: Employees are feeding sensitive data to ChatGPT, raising security fears

#164

Post by ChatPGT »

osterbit2 wrote: post #132
probablynish wrote: post #104

Earlier quoted context omitted.

This really depends on the cost/benefit tradeoff for the entity in question. If using ChatGPT makes you X% more productive (shipping faster / lowers labor costs / etc), but comes with Y% risk of data leakage, is that worth it in expectation or not? I would argue that there definitely exist companies for which it's worth the tradeoff. By the way, OpenAI says they wont use data submitted through its API for model train…

To anyone who may be pasting code along the lines of 'convert this sql table schema into a [pydantic model|JSON Schema]' where you're pasting in the text, just ask it instead to write you a [python|go|bash|...] function that reads in a text file and 'converts an sql table schema to output x' or whatever. Related/not-related--great pandas docs replacement is another great+safe use-case. Point is, for a meaningful subs…

I'm doing that since day one. I can't believe people are pasting real data into this corporate black boxes.

Re: Employees are feeding sensitive data to ChatGPT, raising security fears

#165

Post by jupp0r »

msm_ wrote: post #91
yathrowaway01 wrote: post #81

Earlier quoted context omitted.

Glad I work for a company where the CEO pays for everyones ChatGPT Plus for the devs. If you think your code is special then you're wrong.

But you created a throwaway account specifically to reply in this thread? Unless your company really has nothing to hide, it's easy to accidentally dump a company secret or an API key in a chat session. Of course if everyone is aware of this and constantly careful then you may be OK.

If your code has API keys in it, you have bigger problems than ChatGPT.

Re: Employees are feeding sensitive data to ChatGPT, raising security fears

#166

Post by avereveard »

renewiltord wrote: post #113
jackson1442 wrote: post #85

Earlier quoted context omitted.

I think this is different in that ChatGPT is expressly using your data as training in a probabilistic model. This means: * Their contractors can (and do!) see your chat data to tune the model * If the model is trained on your confidential data, it may start returning this data to other users (as we've seen with Github Copilot regurgitating licensed software) * The site even _tells you_ not to put confidential data in…

Not that I don't expect them to do this, but how is it expressly said to be so? https://help.openai.com/en/articles/5722486-how-your-data-is... > OpenAI does not use data submitted by customers via our API to train OpenAI models or improve OpenAI’s service offering. In order to support the continuous improvement of our models, you can fill out this form to opt-in to share your data with us. Sharing your data with us…

Hehe old tos trick. Here it doesn't say "will never use" but say "does not use" and I wager below or somewhere will say that they can change the tos at any time in the future unilaterally

Re: Employees are feeding sensitive data to ChatGPT, raising security fears

#167

Post by grepfru_it »

m000 wrote: post #156
cuuupid wrote: post #5

We block ChatGPT, as do most federal contractors. I think it’s a horrible exploit waiting to happen: - there’s no way they’re manually scrubbing out sensitive data so its bound to spill out from the training data when prompting the model - OpenAI is openly storing all this data they’re collecting to the extent that they’ve had several leaks now where people can see others’ conversations and data. We are one step away…

Does US intelligence have access to OpenAI data? Private organizations is one thing. But with all the dopes in government positions around the world, OpenAI logs would probably be a treasure trove for intelligence gathering.

They are just one national security letter away from all US-held data.

Re: Employees are feeding sensitive data to ChatGPT, raising security fears

#169

Post by renewiltord »

kristofferR wrote: post #151
renewiltord wrote: post #113

Earlier quoted context omitted.

Not that I don't expect them to do this, but how is it expressly said to be so? https://help.openai.com/en/articles/5722486-how-your-data-is... > OpenAI does not use data submitted by customers via our API to train OpenAI models or improve OpenAI’s service offering. In order to support the continuous improvement of our models, you can fill out this form to opt-in to share your data with us. Sharing your data with us…

Did you read the next paragraph? > When you use our non-API consumer services ChatGPT or DALL-E, we may use the data you provide us to improve our models.

I definitely did not correctly read that. Thanks for the clarification. Totally misread the 'our API' bit!

It's also in the FAQ: https://help.openai.com/en/articles/6783457-chatgpt-general-...

> Will you use my conversations for training?

> Yes. Your conversations may be reviewed by our AI trainers to improve our systems.

Re: Employees are feeding sensitive data to ChatGPT, raising security fears

#170

Post by waboremo »

mholm wrote: post #154
waboremo wrote: post #123

Earlier quoted context omitted.

Sticking it in your own datacenter doesn't really prevent any of these problems (except maybe #2), only now your leaks are internal and because of all the false sense of security, you might wind up leaking far more confidential and specific information (ie. an executive leaking to the rest of the team in advance that they are planning layoffs for noted reasons, whereas that executive might have used more vague terms…

Sticking it in your own private datacenter would imply that you can opt in or out of using your data to train the next generation. ChatGPT does not dynamically train itself in realtime.

The implication is that you would bother with ChatGPT at all to train it on the relevant local data, the key value aspect to ChatGPT beyond general public use.
Post reply on HN