What is it about an AI chat bots that makes the risk of a data leak so much higher? Is something about OpenAI's ToS? Or it's relative infancy?
“(c) Use of Content to Improve Services. We do not use Content that you provide to or receive from our API (“API Content”) to develop or improve our Services. We may use Content from Services other than our API (“Non-API Content”) to help develop and improve our Services. You can read more here about how Non-API Content may be used to improve model performance.”
https://web.archive.org/web/20190224031626/https://blog.open...
> Chat History & Training Save new chats to your history and allow them to be used to improve ChatGPT via model training. Unsaved chats will be deleted from our systems within 30 days.
Most people do not change most default options. And companies know this.
If you dig into the Settings you can disable sharing chats with OpenAI, but you lose access to just about every feature including saving chats. You can only have one chat at a time, and if the window is closed or refreshed your chat is wiped. it's kind of like if opening a "Private Browsing" window prevented you from having a regular browsing window open and also had no tabs.
For some reason, they still retain your chat for "up to 30 days" despite not letting you save or access it after the page is refreshed.
They need to use an asynchronous system to be tracking when your chat becomes "finished" and then likely queue it up to a system looking to propagate deletes. They have to choose some kind of SLA on that and probably went with a common data privacy user data deletion window of 30 days.
That sentence does not claim OpenAI does not use such Content for other purposes besides "developing and improving the Services". For example, using the Content in a manner that potentially harms Samsung's business.
What does "develop or improve our Services" even mean? There is no definition.
Third, how would anyone outside of OpenAI know how OpenAI uses the Content. For example, what if OpenAI was using Content from Services other than the API for purposes other than "to develop and improve our Services" (assuming anyone could prove what thet even means). How would anyone outside of OpenAI discover this was happening?
If we search these "ToS" for phrases like "You will" or "You will not", we see that users make promises to OpenAI. However if we search for phrases like "We will" or "We wil not", we see that there are no instances where OpenAI promises anything. IMHO, these "ToS" are better characterised as "ToU". Not to mention being found at "/policies/".
As a ChatGPT user, OpenAI does not owe you anything, unless perhaps you are Microsoft. For you, the "terms" can change at any time, for any reason, without any prior notice.
Let's imagine some far-fetched scenario where someone inside the company leaks information that suggests OpenAI is using Content from Services other than the API for purposes other than "improving or developing the Services". Then what?
OpenAI has not promised to refrain from using Content for certain purposes. There is no breach of these ToS if OpenAI uses the Content for whatever purposes it desires.
Maybe Samsung could claim something like (a) OpenAI misrepesented facts in their ToS, (b) that induced Samsung into using OpenAI, and (c) as a result Samsung suffered harm. Needless to say, claims like that are difficult to prove and any recovery is limited. Whatever creative legal claims Samsung could could up with, none of them would fix damage already done to Samsung from its employees having used OpenAI.
Though, they don't define "developing and improving".
> Save new chats to your history and allow them to be used to improve ChatGPT via model training
From what I personally have seen, this sort of guidance remains. When companies do use things like Google Docs or Microsoft Office365, they likely have some specific contract in place with Google / Microsoft / etc., that the company's legal team has decided they are happy with.
I anticipate that the same will eventually be true of ChatGPT and such, that there will be some paid corporate offering with contract terms that make the company lawyers happy.
Most of my career has been with larger companies, often with high data sensitivity; I can easily imagine that some smaller and/or less data-sensitive companies might not care about any of this.
The cloud is a terrible bet for many large companies. The benefits are minimal while the risks are huge, however what’s in the best interest for the company is only tangentially related to what happens.
It’s really difficult to ensure companies actually take low probability risks seriously. A 1% chance to lose 10 billion dollars is an easy bet for upper management to make when their personal risks and rewards don’t line up with the company’s risks and rewards.
As to the risks, many companies live and die by their internal secrets. These range from a private keys, customer lists, trading strategies, and similar trade secrets to actual serious R&D efforts.
Sometimes the damage is obvious such as crypto exchanges suddenly finding themselves broke, but corporate espionage can also be kept quite. Losing major government bids because a competitor read some internal memo’s is a serious risk and you may never know.
It’s much harder to reconstruct actionable intelligence from a huge stream of people using Google search even if they’re using it to preform sensitive calculations.
There’s plenty of high profile fuckups from people falling to AWS specific gotcha’s.
Yes they do. Where I work the whole google office suite is blocked from inside the network (you have to use MS Office). ChatGPT is blocked. Most web apps that you can copy text or data into are either blocked, or we have an agreement with the provider, or (for open source) we have an internal on-prem fork.
So prior to that, they were willing to use your data for model training. Every service may have leaks/security issues, but few say they'll purposely use your data. OpenAI probably should've promised not to use your data from the beginning; it'll be a hard perception to change now.
https://techcrunch.com/2023/03/01/addressing-criticism-opena...
A dark pattern that tends to provoke an unintentional behavior does not seem to be likely to hold up as "agreement"
E.G. you’ll probably be able to use the corporate account to sign into the corporate Google Docs or O365 instance but if you try to sign into your own it would be blocked and likely also reported on so you might get a call from SecOps down the line.
OpenAI currently offers none of it and more importantly it openly uses the data that users submit to it as well as the responses for additional training and any other purpose they might come up with.
As for browsers these are also often also configured not to send data outside of the company and yes it’s possible. Windows 11 web search and other features would also likely be disabled on your corporate device.
Companies generally tend to be wary of cloud services due to data leak concerns. At the very least, they like to be in control of the decision about which services are approved and which are not.
How will that private/proprietary information be used by OpenAI? Does it include NDA information from another company that they don't have the right to share? How secure is the information stored (think industrial espionage)? There is a lot that needs to be taken into account that even goes beyond this.
With ChatGPT, you get researchers paid over $1m per year [1] to use you as a training data source and ship stuff with basic bugs and then "feel sorry" when stuff breaks: https://www.theregister.com/2023/03/23/openai_ceo_leak/
Another position for those like Samsung: preventing ChatGPT use encourages incubation of internal competing solutions.
[1] https://davidgoudet.medium.com/how-did-this-ai-scientist-end....
We are not to use any third party cloud hosted software that is not approved to store proprietary information.
There are only three external SaaS companies that I am aware of that we use that stores anything proprietary.
We are not even allowed to take pictures of the whiteboard because the pictures can be synced to external cloud storage providers.
I would have concerns about Google using my data but I wouldn't be concerned that the data I enter could easily appear in someone else's spreadsheet.
This is the same thing.
I see a distinction between several kinds of companies:
Competent companies are asking employees to be more productive and are training them with AI.
Less competent companies are restricting use of AI.