So I’m confused to the logic here. You’re running Mac OS, which can call out to all kinds of external services, even from the terminal. Siri is debatably a third party AI feature itself. Why is that OK but this is toxic?
Yes, it's overkill, but legal's stance is that anything that can possibly talk to a third party AI service is forbidden regardless of the other technical solutions in place preventing information leakage.
FWIW, anything that has telemetry to third parties (crash reports, usage stats) are also forbidden, with extremely limited exceptions that legal has approved.
Technical means, we monitor for every outbound connection attempt and DNS request and can trace it back fairly easily to a particular application. We've certainly caught software that was reporting back when it's stated otherwise in the privacy policy or website.
Legal does feel better when there's an entity they can seek damages from in the event that a piece of software turned out to be malicious. They're less inclined to give free software the same benefit of the doubt.
So then your company just needs to block AI at the network level then?
Within a few keystrokes you could already very easily communicate with third party AI services via terminal prior to 3.5 (curl... etc)
This is a very weird over-reaction considering what iTerm2 and shells in general are already capable of.
And iTerm2 itself has allowed for custom python scripts to be loaded for a long time [https://iterm2.com/python-api/] easily modifying the behavior (and also allowing outbound connections wherever...)
If you work in a sensitive environment and outbound connections to OpenAI are already blocked on the network level (or even better iTerm is only able to communicate to whitelisted hosts, then problem solved... there really is no issue here for people to be so worked up about).
Sounds like legal really needs to understand these tools better.