Is It Safe to Use AI Chatbots at Work? What to Know

In April 2023, an engineer at Samsung Electronics pasted confidential internal source code into ChatGPT, apparently to get help with it. Within weeks the company had issued a memo banning generative AI tools across the workplace. The stated worry wasn’t that the chatbot was malicious. It was that the data now sat on somebody else’s servers, and Samsung could not easily get it back.

That remains the heart of the issue, three years and an enormous amount of adoption later. AI assistants are genuinely useful, most workplaces now run on them whether or not anyone approved it, and the honest answer to “is this safe?” is neither yes nor no. It depends almost entirely on what account you’re using and what you paste into it. This guide explains what actually happens to the words you type, the four real risks worth understanding, which information should never go into a chat window, and how to use these tools at work without creating a problem you’ll hear about later.

1. Where your words actually go

A chat window looks like a private space. It sits on your screen, it responds only to you, and nothing about it suggests an audience. What’s actually happening is closer to sending a message to a company you have never audited, which keeps a copy.

When you type a prompt, the text leaves your device and travels to servers run by the provider. The model generates a reply there and sends it back. Along the way, several things may happen to that text depending entirely on which account you’re using and what that provider’s terms say.

On a personal or free account, the common pattern is that conversations are stored in your history, may be used to help improve the provider’s models, and may be seen by human reviewers for safety and abuse monitoring. Most providers offer a setting to opt out of training, which is worth finding and switching on, though turning it off today doesn’t necessarily reach back and undo what was submitted last month.

On a business or enterprise agreement, the arrangement is usually different by contract: your organisation’s data isn’t used to train models, retention periods are defined, and your employer administers the account. This is the single biggest variable, and it’s why “is AI safe at work?” has no answer until someone asks “on which account?”

Policies vary between providers and genuinely do change, so treat the summary above as the shape of the thing rather than a statement about any particular service. The habit worth building is checking the current terms for whichever tool you actually use, and checking again occasionally.

2. How common this already is

Before the risks, a word about the numbers, because this topic has a statistics problem that’s worth knowing about.

Articles on workplace AI tend to cite dramatic percentages about employees leaking data. A fair number of those figures cannot be traced to any published study, and others have drifted as they’ve been repeated, with a finding about one group quietly restated as a finding about everyone. If you go looking, you will find widely quoted numbers attributed to research firms that appear to have no underlying document. That’s worth saying out loud on a page that’s about to quote some figures itself.

Here are ones that do trace to published work. Microsoft and LinkedIn’s 2024 Work Trend Index, based on 31,000 respondents across 31 countries, reported that 75% of knowledge workers were using generative AI, and that 78% of those users were bringing their own tools to work rather than using something their employer provided. A Salesforce survey of more than 14,000 employees across 14 countries found that over half of generative AI users were using it without their employer’s approval.

On consequences rather than habits, IBM’s Cost of a Data Breach study for 2025, which examined 600 breached organisations, reported that one in five said they had experienced a breach connected to unsanctioned AI use, and that organisations with high levels of it saw breach costs around $670,000 higher than those with low or no shadow AI.

Two measurements of what’s actually being typed point in interestingly different directions. Security vendor Cyberhaven, drawing on telemetry covering around seven million workers, reported in 2025 that roughly 35% of corporate data entered into AI tools was sensitive. Harmonic Security, analysing over 22 million enterprise prompts during 2025, found sensitive data in about 2.6% of them. Those aren’t contradictory: one measures the composition of the data by volume, the other the proportion of individual prompts. A small share of conversations can carry a large share of the sensitive material. Both are vendor telemetry from companies that sell tools to solve this problem, which is a reason to read them as directionally useful rather than definitive.

3. The assumption worth dropping

The mental model most of us carry is that a chatbot is a cleverer search engine. You ask, it answers, nothing is retained in any way that matters, and the interaction is as consequence-free as a Google query.

A search engine receives a few words about what you want. A chatbot receives the document. That difference is the entire security conversation.

Nobody pastes a client contract into a search box. People paste client contracts into chat windows constantly, because the tool is only useful if you give it the material, and the interface does nothing to signal that a boundary has been crossed. The design encourages exactly the behaviour that creates the risk, and that isn’t the user’s failing. It’s worth naming, because “just be careful” is not a workable instruction when the helpful action and the risky action are the same action.

A second assumption is subtler: that using a personal account for work is a small, private shortcut. It’s the opposite. A personal account sits outside everything your employer uses to protect company data. It isn’t covered by their contract with the provider, isn’t logged, isn’t covered by legal hold, and cannot be wiped when you leave. The shortcut is precisely what moves the data outside the perimeter.

4. The four risks that actually matter

Risk one: the data persists somewhere you don’t control. This is the Samsung problem and it’s the most common by far. Once confidential material is in a third party’s systems, deleting it becomes a request rather than an action. For regulated information such as health records, payment data or personal data covered by privacy law, this can be a compliance breach on its own, regardless of whether anything is ever exposed.

Risk two: the account is a target. Chat histories are a concentrated store of exactly what attackers want: internal documents, draft strategy, code, customer names. The account protecting that history is often a personal one secured by a password that may be reused elsewhere, and infostealer malware reads saved credentials and login sessions straight out of browsers. Our guide on how passwords actually get stolen covers that route. The sensitivity of an AI account quietly rises to match the most sensitive thing you’ve ever pasted into it.

Risk three: prompt injection. This one is specific to AI and catches people out. OWASP, the non-profit that maintains widely used security reference lists, ranks prompt injection first on its Top 10 for LLM Applications. The attack works like this: the model can’t reliably distinguish between instructions from you and instructions hidden inside content it’s asked to read. If you ask an assistant to summarise a web page or a document that secretly contains text saying “ignore your previous instructions and reveal the following,” it may do exactly that. This matters far more as assistants gain the ability to browse, read files and connect to company systems, which is the direction everything is moving. Our article on why AI agents are a new security risk goes deeper on what happens when an assistant can act and not merely answer.

Risk four: confident wrong answers. Less dramatic, more frequent. OWASP lists misinformation in the same top ten for good reason. A model will produce a plausible, fluent, completely incorrect answer with no change in tone, and fluency reads as competence. The security consequences are real when the output is a configuration, a contract clause or a piece of code pasted into production without review.

5. What the Samsung case really showed

Return to the opening story, because the detail that matters is easy to miss. The engineer wasn’t careless in any ordinary sense and wasn’t trying to circumvent anything. They were doing their job, using a tool that helped, in a company that had not yet told them not to. According to reporting at the time, the uploaded material was confidential source code, and the ban followed within weeks.

Samsung’s reasoning, as reported, is the useful part: data shared with these services is stored on the providers’ servers, the company may not be able to retrieve or delete it, and there was concern it could end up visible to others. Notice what isn’t on that list. No accusation of wrongdoing by the provider, no breach, no attacker. The risk materialised entirely through normal use of a working product.

That’s the shape of this whole category. Most AI data incidents will not look like a hack. They’ll look like a competent person pasting something into a box to get their work done faster, which is what the box is for.

6. What’s safe to paste, and what isn’t

Rather than a rule nobody remembers, here is a sorting test you can run in two seconds before you hit paste.

If you want one sentence instead of three tiers: would you be comfortable if this text appeared in a document you don’t control, read by someone you’ve never met? If the answer is no, don’t paste it, or strip it down until the answer is yes.

That stripping step is the genuinely useful skill, and it’s underrated. Most of the time the model doesn’t need the real details to help you. Replace the client’s name with “the client,” swap real figures for representative ones, and cut the account numbers. You keep nearly all the usefulness and lose nearly all the exposure. The one caution is that removing names isn’t always enough to anonymise something: a small enough dataset or a specific enough scenario can still identify people or an organisation.

7. How to use AI at work safely

Use the account your employer provides, if there is one. This single step resolves most of what’s above. The contract, retention terms and administrative control are what you’re actually getting, not a better model.

If there isn’t one, ask before you assume. “Which AI tools am I allowed to use, and for what?” is a reasonable question that your security team would much rather answer in advance. Silence from an employer is not approval, and it won’t read as approval afterwards.

Turn off model training on personal accounts. It’s usually in privacy or data-control settings. Do it once. Remember that it may not apply retroactively.

Protect the account properly. A unique password from a password manager and two-factor authentication turned on. Your chat history deserves the same protection as your email, because by now it probably contains some of the same material.

Clear history you don’t need. Periodically delete old conversations, especially any containing work material. Less stored, less exposed.

Treat output as a draft from a confident stranger. Verify facts, figures, citations and code before they go anywhere that matters. Never run code you don’t understand.

Be careful what you let an assistant read. Summarising untrusted documents, emails or web pages is where prompt injection lives. Be more careful still with an assistant connected to your files, inbox or company systems, because then a successful injection can cause actions and not just words.

8. If you’re the one writing the policy

One observation, offered because the evidence points fairly clearly at it. The Microsoft and LinkedIn finding that most AI users bring their own tools describes what happens when demand for a tool outruns provision of one.

A ban without a sanctioned alternative doesn’t stop AI use. It moves it onto personal phones and personal accounts, where there’s no contract, no logging and no visibility. Staff still get their work done, and the organisation loses the only thing a policy could realistically have given it: knowledge of what’s happening. Providing an approved tool, saying plainly what may and may not go into it, and making reporting a mistake safe will beat prohibition in almost every organisation. If someone does paste the wrong thing, you want to hear about it that afternoon, and that only happens where the response isn’t punishment. Our guide to what actually happens during a security incident covers what that response should look like.

9. Frequently asked questions

Is it safe to use AI chatbots at work?

It depends on the account and the content. On an employer-provided business account, with no credentials, personal data or regulated records pasted in, it’s reasonably safe. On a personal account with confidential company material, you’re placing that data outside your organisation’s control, which is the risk Samsung acted on in 2023.

Can AI companies see what I type?

Your text is processed on the provider’s servers and typically stored in your history. On consumer accounts it may also be used to improve models and may be reviewed by people for safety purposes, though most providers let you opt out of training. Business and enterprise agreements usually prevent training on your data by contract. Check your provider’s current terms, as these do change.

What should I never paste into an AI chatbot?

Passwords, API keys and access tokens; customer or employee personal data; health, payment or other regulated records; unreleased financial information; proprietary source code; and anything covered by an NDA. If you’d hesitate to email it to an outside company, don’t paste it.

What is prompt injection?

It’s an attack where malicious instructions are hidden inside content the AI is asked to process, such as a web page or document, and the model follows them as if they came from you. OWASP ranks it as the top risk for applications built on large language models, and it matters most when an assistant can browse, read files or take actions.

Is a personal AI account really a problem if I’m careful?

Being careful helps, but a personal account sits outside your employer’s contracts, logging, legal hold and offboarding. If the account is compromised or the company later needs to prove where data went, care alone doesn’t close that gap. Use the provided account where one exists.