In 2023, a Samsung memo said engineers had accidentally leaked internal source code by uploading it to ChatGPT, and the company restricted generative AI tools. Reports did not say what the code was or whether anyone outside Samsung saw it. The case is a clear example of pasted data leaving company control.
What was reported
CSO Online's coverage, based on the memo first reported by Bloomberg, says the following:
- Engineers "accidentally leaked internal source code by uploading it to ChatGPT" in April 2023.
- The memo did not say what the code was, or whether anyone outside Samsung inspected it.
- Employees were warned not to upload company related data or intellectual property to such tools, and that doing so could lead to termination.
- The rationale given was that data entered into an AI tool sits on external servers, which makes retrieval and deletion hard and may make it accessible to other users.
- About 65% of employees in an internal survey, run roughly a month before the ban, said ChatGPT posed serious security threats.
- The restriction was described as temporary while headquarters reviewed security measures for safe use. Samsung was reportedly working on internal AI tools and on ways to block uploads of sensitive data.
Other outlets described the scope of the ban differently, covering which divisions and devices it applied to. This post does not settle that.
What it shows
The incident is not about a hack. Staff did what felt natural: they pasted code into a helpful tool to find errors. No attacker was needed.
That has three consequences for any company.
- Convenience wins over policy memos. If the approved route is slow or missing, people use the fast one.
- The risk is the data, not the tool. Swapping one chat product for another does not remove it.
- A ban is a pause, not a plan. The reported memo itself called the restriction temporary.
What to set up instead of only banning
- Offer an approved tool. Choose one with terms you have read, covering retention and training use.
- Write the rule in plain words. What may be pasted, what may not: source code, credentials, customer data, unreleased plans.
- Block the obvious leaks. Secrets scanning in editors and pre commit checks catch keys before they go anywhere.
- Train with examples. Show real cases like this one.
- Review on a schedule. Tools and terms change.
See what to put in an employee generative AI use policy and AI coding assistant data leakage paths.
Safeguard's policies, gates and guardrails can enforce rules in the development workflow, and compliance and evidence automation helps you keep proof that the policy runs.
Quick check
Do we know what Samsung's code contained?
No. The reports say the memo did not disclose it.
Is banning generative AI the lasting answer?
The reported memo called it temporary. Most teams need an approved tool and clear rules.
Sources
Last reviewed: 19 October 2026.
