What Happened When Samsung Engineers Pasted Code Into ChatGPT
Samsung engineers reportedly posted sensitive data into ChatGPT. Samsung responded with a size limit for prompts, but that doesn't differentiate a routine question from proprietary code. ORION Labs maps each path the data takes and where it could be stopped.
.png)
Key Takeaways:
Key Takeaways
- Audit which AI tools run on accounts you can’t administer. In ORION’s Data Loss Threat Model, an approved tool on consumer accounts still counts as shadow AI, and Samsung’s pastes fall on path A1 (submit or upload to shadow AI).
- Judge what is pasted, not how much. Samsung’s 1,024-byte limit still let through 25 to 35 lines of code per question.
- Make sure a ban covers any team at risk. Samsung’s May 2023 ban covered its device division but not the chip division, where every paste happened.
- Back your AI policy with a check at the paste. Samsung told staff on day one to keep internal information out of prompts, and three such pastes followed within 20 days.
Introduction
Twenty days after Samsung's chip division opened ChatGPT to its engineers, one of them pasted in faulty source code and asked for a fix. Another pasted code used to find defective equipment. A third fed in a recording of an internal meeting to get minutes. That's according to Korean press reports, which Samsung never confirmed.
Samsung responded by limiting the size of each question for ChatGPT, then banning the tool everywhere except the division where the pastes happened.
But neither fix looked at what was being pasted into the AI tool.
How Approved Access Ran on Consumer Accounts
Samsung's semiconductor division opened ChatGPT to its staff on March 11, 2023, but the device and appliance division, known as DX, stayed barred from it. OpenAI didn't offer a business tier until ChatGPT Enterprise in August 2023, so every session ran on a consumer account Samsung couldn't administer, with no tenant or admin console. The ORION Data Loss Threat Model calls a tool running outside enterprise governance shadow AI.
A Warning Three Days In
When Samsung opened access, it told staff to be careful with internal information and not to enter private content, according to Economist Korea. Three days later, the UK's National Cyber Security Centre warned that anything typed into a public model is visible to the provider, stored, and will almost certainly be used to develop the service.
Both said the same thing: keep sensitive information out of prompts. Within 20 days, the warning didn't hold at Samsung.
How Three Pastes Got Out
No forensic record of the route has been published, only press reports. The two code pastes took a single hop, from a clipboard to a domain Samsung had approved. The meeting paste took a longer road. Someone recorded the meeting on a smartphone, turned it into a document with Naver's Clova app outside any company browser, then entered the text into ChatGPT.
A Paste That Never Became a File
Once sent, the text stayed sent. That same month, OpenAI's help center said ChatGPT data "may" be used to improve its models, with opt-out by form. OpenAI's API had stopped training on customer data on March 1, but that policy excluded consumer ChatGPT, the app Samsung's staff were using.
Found After the Fact
Economist Korea broke the story on March 30, 19 days after Samsung opened access. It says Samsung identified the incidents, but not how.
Samsung knew what each paste contained, but only after OpenAI already had the text.
A Size Limit Samsung Had to Police
The same report says Samsung limited each ChatGPT question to 1,024 bytes and warned that it could block ChatGPT on the company network if another leak happened. ChatGPT didn’t have admin controls Samsung could use, so the limit had to be enforced on Samsung's side, either by a proxy reading the traffic or by software on each laptop.
When a company doesn't control the tool, a blunt limit like that is one of the few options it has. But a kilobyte still holds roughly 25 to 35 lines of code, or about 340 Korean syllables, since each Korean character takes three bytes. A longer program can go in as several smaller pastes, and each one looks like ordinary use of an approved tool.
What It Cost Samsung
The first cost was control of the code. Yield analysis is how a fab decides which wafers came out good and why the rest didn't, so code like that usually encodes process knowledge. Samsung's internal notice, as Economist Korea quoted it, warned staff that anything entered goes to external servers, is stored there, and can't be retrieved.
The second was reputational. Three unconfirmed pastes became a standard example of AI data leakage, cited in the OWASP Top 10 for LLM applications under sensitive information disclosure. Because the case was reported as a trade-secret problem rather than a personal-data one, no regulator ever took it up.
The Ban That Skipped the Chip Division
On May 1, 2023, Samsung emailed employees that generative AI tools were banned on company devices, effective immediately. The memo acknowledged some cases of misuse in the chip division and warned of discipline up to dismissal.
The ban covered the device division, DX, which had never been allowed to use AI tools. The chip division got a separate notice that etnews described as an effective request not to use the tool, and it kept using ChatGPT under the size limit for about two years.
Three Years Back to ChatGPT
In October 2024, a Samsung union wrote to the chairman calling it "stupidity itself" to have the best tools and not use them. In 2026, Samsung returned to ChatGPT on an enterprise contract, with OpenAI announcing ChatGPT Enterprise for Samsung's employees in Korea and the chip division preparing its own rollout.
Had ORION been on the first employee’s laptop in March 2023, our browser extension would have caught the paste in the ChatGPT prompt box, our classification would have read it as proprietary source code, and the paste would have been denied before the request left the browser.
What Would Have Caught the Code in the Prompt Box
Samsung's approved tool stayed shadow AI because nobody at Samsung could administer the accounts it ran on. In the ORION Data Loss Threat Model, that puts every paste on path A1 (submit or upload to shadow AI).
Most companies can't see that path at all. When Victoria's child-protection department in Australia investigated after a worker put a child's case details into ChatGPT, its logs showed nearly 900 staff had visited the site, but not what any of them typed.
How the ORION Platform Would Have Seen It
The example for A1 in our threat model is a project manager giving a statement of work to a personal ChatGPT account. Samsung's movement was shorter—a copy and a paste with no file in between—the same trace as our T3.5 example with ChatGPT in place of a personal Notion.
Had ORION been on the first employee’s laptop in March 2023, our browser extension would have caught the paste in the ChatGPT prompt box, our classification would have read it as proprietary source code, and the paste would have been denied before the request left the browser. The employee could still have asked ChatGPT about the error, just without the code.
Samsung's limit on ChatGPT focused on the number of bytes. Our classification reads each paste the moment it moves, so every fragment under 1,024 bytes still gets its own verdict.
Our LLM-based classification judges the text itself, and custom classifications set by simple prompts can teach it, for example, what a fab treats as sensitive, such as yield and defect-analysis logic that no regex could describe.Our identity context adds each user's department, and every event can be followed back to the user, the data, and the destination.
That record can also matter in court. Under U.S. law, information only counts as a trade secret if the company took "reasonable measures to keep such information secret," and Korean law only if it was managed as secret. A memo to employees about AI use shows a company had a rule. A record of every blocked paste in an AI tool shows it enforced that rule.
Conclusion
Samsung's staff used the tool Samsung gave them, on consumer accounts it couldn't administer, and both of its fixes acted on the tool instead of what was actually pasted into ChatGPT.
Three years later, Samsung returned to ChatGPT on an enterprise contract, which governs the account but still doesn't judge what goes into the prompt. That paste is path A1 in our Data Loss Threat Model, and it's where our browser extension puts an allow, warn, or deny verdict before the text leaves the browser.
Book a demo and see how ORION keeps source code, customer data, and internal documents out of the AI tools your teams already use, approved or not.
Sources
- [Exclusive] Fears Come True as Samsung Electronics Sees Misuse Right After Lifting Its ChatGPT Ban (in Korean). Economist Korea, March 30, 2023.
- ChatGPT and LLMs: What's the Risk. UK National Cyber Security Centre, March 14, 2023.
- How Your Data Is Used to Improve Model Performance (archived). OpenAI Help Center, March 14, 2023.
- API Data Usage Policies (archived). OpenAI, March 2023.
- OpenAI Launches a ChatGPT Plan for Enterprise Customers. TechCrunch, August 28, 2023.
- LLM02:2025 Sensitive Information Disclosure. OWASP Top 10 for LLM Applications.
- Press Release on Sanctions Against OpenAI (in Korean). Personal Information Protection Commission, July 27, 2023.
- Samsung Bans AI Chatbots After Leak. The Korea Herald, May 3, 2023.
- Samsung Electronics Issues ChatGPT Ban Over Leak Fears (in Korean). Edaily, May 2, 2023.
- Samsung Electronics' DX Division Bans ChatGPT Over Company Data Leak Concerns (in Korean). Etoday, May 2, 2023.
- Samsung Electronics Bans ChatGPT Use While Preparing Its Own Solution (in Korean). etnews, May 2, 2023.
- Samsung Chip Division's ChatGPT Approval Rule Leaves Staff Struggling (in Korean). Money Today, July 4, 2025.
- Samsung Electronics Chip Division to Require Approval for ChatGPT Use Over Security Concerns (in Korean). Money Today, June 12, 2025.
- Samsung Union Writes to Lee Jae-yong and Chung Hyun-ho Urging ChatGPT Access and HR Reform (in Korean). Etoday, October 18, 2024.
- Samsung AI Forum 2023 Day 2, Discussing Technological Trends and the Future of Generative AI. Samsung Global Newsroom, November 2023.
- Samsung Electronics Introduces Generative AI to Support Internal Work (in Korean). etnews, December 18, 2023.
- Samsung Electronics to Introduce ChatGPT, Gemini, Claude in Operations. The Korea Times, June 11, 2026.
- Samsung Electronics ChatGPT and Codex Deployment. OpenAI, 2026.
- Samsung Chip Organization Pursues ChatGPT Enterprise, Moving From Blocking AI to Managed Use (in Korean). Aju Business Daily, July 23, 2026.
- Investigation Into the Use of ChatGPT by a Child Protection Worker. Office of the Victorian Information Commissioner, 2024.
- 18 U.S.C. § 1839, Definitions (Defend Trade Secrets Act). Legal Information Institute, Cornell Law School.
- Unfair Competition Prevention and Trade Secret Protection Act, Article 2 (in Korean). Casenote.
