三星工程师把源码与会议记录贴进 ChatGPT：解禁不到三周，至少三起内部敏感信息外发Samsung engineers pasted source code and meeting notes into ChatGPT: within three weeks of the tool being unbanned, at least three internal leaks

Within three weeks of Samsung unbanning generative AI, employees pasted semiconductor source code, equipment test code and meeting transcripts straight into external consumer tools. There was no data classification and no control over outbound channels.

At least three internal leaks reached third-party platforms; once pasted, the content could neither be recalled nor audited by the company.

No model misbehaved here; people treated an external tool as an internal system. The failure sits at Access Control: no classification, no channel control and no interception stood between sensitive data and outside tools, and the unbanning decision ran ahead of the controls.

Before approving any external AI tool, answer three questions: what data must never go in, through which channel it may go in, and whether it can be taken back. Unanswered, the approval itself is the start of the incident.

Classify before you approve: data classification and outbound-channel controls land before any tool unbanning; unclassified data stays out of external AI tools by default.

Stage the tightening: Samsung's sequence is reusable: cap input size first, then ban, while building an internal alternative.

Make outbound use auditable: approved AI channels keep checkable records; content that cannot be recalled should at least be known.