16 ms·

Employees are feeding sensitive data to ChatGPT, raising security fears

• nareshorange 4y ago
  Test
• sigstoat 4y ago
  when it first came out and my boss was behind himself about how cool it was, he was feeding it all of his emails with other businesses to have it clean them up. boggled my mind.
  • dannyobrien 4y ago
    do those other businesses use gmail? does your company?
    • SketchySeaBeast 4y ago
      I think those are different models. Gmail has a vested interested in keeping any knowledge it gains about you secret - it's competitive advantage is knowing more about you than anyone else does. ChatGPT's strength is its ability to clearly communicate the knowledge it has (including training data it gains from people it interacts with) to give you good responses.
      • mewpmewp2 4y ago
        I am still not seeing a huge threat to be honest. This is not how attacks are done. OpenAI also has vested interest to keep your data safe and is strongly linked to Microsoft. Most corps, companies store a lot of internal data with corps like Google, Microsoft, Amazon and others.
• guestbest 4y ago
  This is a user led data leak that ranks up there with Facebook and LinkedIn asking for email passwords to “look for your contacts to add”.
• varunjain99 4y ago
  Not only do you have to worry about employees directly sharing data, but many companies are also just wrappers around GPT. Or they may use your data in the future to roll out new AI services. While this is not a new problem -- employees share sensitive data with Google all the time -- the data leakage will be more clear than ever. With ads-based tracking and Google search, the leakage was very indirect. With generative AI, it can literally regurgitate memorized documents. The security risk goes beyond data exfiltration. Folks are already trying to teach the AI incorrect information by spamming it with something like 2+2 = 5. Data exfiltration + incorrect data injection are super underrated risks to mass adoption of generative AI tech in the B2B world...
• cuuupid 4y ago
  We block ChatGPT, as do most federal contractors. I think it’s a horrible exploit waiting to happen: - there’s no way they’re manually scrubbing out sensitive data so its bound to spill out from the training data when prompting the model - OpenAI is openly storing all this data they’re collecting to the extent that they’ve had several leaks now where people can see others’ conversations and data. We are one step away if it hasn’t already happened from an exploit of their systems (that likely weren’t built with security as the top priority as opposed to scale and performance) that could leak a monumental amount of data from users. In the most innocent case they could leak the personal info of naive users. But largely if Linkedin is any indication, the business world is filled with dopes who genuinely believe the AI is free thinking and better than their employees. For every org that restricts ChatGPT use, there are fifty others that don’t, most of which have at least one of said dopes who are ready to upload confidential data at a moments notice. Wouldn’t even put it past military personnel putting S/TS information into it at this point. OpenAI should include more brazen warnings against providing this type of data if they want to keep up this facade of “we can’t release it because ethics” because cybersecurity is a much more real liability than a supervised LM turning into terminator.
  • deleted 4y ago
    [deleted]
  • Ensorceled 4y ago
    Let's also not discount that for every "dope" there is at least one "bad actor" who is willing to take the risk to get an edge in their workplace or appease their managers demands. The warnings will only deter the first group.
  • comment_ran 4y ago
    If your competitor use ChatGPT to compete with you and they're 10x productive than yours, are you still willing to insist? If the productive is 100x, will you?
    • brobdingnagians 4y ago
      It might be just as likely that ChapGPT will cause a mistake like Knight Capital because no one bothered to thoroughly verify the AI's looks-good-but-deeply-flawed answer, and the two aren't mutually exclusive possibilities.
• MarkusWandel 4y ago
  Wouldn't it be trivial to add a "read-only" mode to the LLM's operation, where it uses stored knowledge to answer queries but doesn't ingest new knowledge from those queries?
  • humanistbot 4y ago
    From https://help.openai.com/en/articles/7039943-data-usage-for-consumer-services-faq https://help.openai.com/en/articles/7039943-data-usage-for-c...: > You can request to opt out of having your content used to improve our services at any time by filling out this form (https://docs.google.com/forms/d/1t2y-arKhcjlKc1I5ohl9Gb16t6Sq-iaybVFEbLFFjaI/edit?ts=63cec7c0 https://docs.google.com/forms/d/1t2y-arKhcjlKc1I5ohl9Gb16t6S...). This opt out will apply on a going-forward basis only. It goes to a google form, which is I guess better then them building their own survey platform from scratch that may have more vulnerabilities.
    • meghan_rain 4y ago
      I'd be worried this is also the "how to get banned from OpenAI in the near future" form. and if OpenAI retains a monopoly like Google does for search, you are basically screwed.
      • visarga 4y ago
        No, everyone will have GPT-4 level AI in 6-12 months.
      • ben_w 4y ago
        I'm old enough to remember when newspapers reported hackers being banned from using computers. And IP pirates banned from using the internet. Actually, that one I remember I voted against my local MP after they passed a law to make that the norm. We don't yet have a social, let alone legal, norm for antisocial use of LLMs; even with social media, government rules are playing catch-up with terms of service, and Facebook is old enough that if it was human it could now vote. So, yes, likewise computers/internet/social media, being banned from an LLM if it's a monopoly is going to seriously harm people. But that is likely to be a big "if". The architecture and the the core training data for GPT-3 isn't a secret, and that's already pretty impressive even if lesser than 3.5 and 4.
• w_for_wumbo 4y ago
  This is the issue with a tool so powerful, you can't just tell people not to use it, or to use it responsibly. Because there's too much incentive for them to use it. If it saves hours of a persons' workday, and they're not seeing any of the harm caused from data leakage, there's no incentive for them to not use it. Which is why a private option is so critical. To not fight against human nature, means providing an ability to use the tool in a safe way.
  • JohnFen 4y ago
    There's a dev here who is using ChatGPT extensively in his work. The rest of the team is just waiting for him to get caught and fired. Sharing company data with unapproved external entities is very definitely a firing offense.
    • yathrowaway01 4y ago
      Glad I work for a company where the CEO pays for everyones ChatGPT Plus for the devs. If you think your code is special then you're wrong.
      • strus 4y ago
        > If you think your code is special then you're wrong Your code is not special, but customers data may be. Also, some companies needs to comply to various certifications, and proven leak of source code that was put into some third party tool may be a reason to revoke such certification. Which can cause a serious financial harm to a given company, as it can lead to ex. losing government clients. This is just the tip of the iceberg.
      • helsinki 4y ago
        Your code might not be special, but I think plenty of hedge funds and prop trading firms beg to differ.
      • croes 4y ago
        You are still transferring your business data to an external entity, but on top of it you pay for it. And if you think that there is no special code then you're wrong.
• phineyes 4y ago
  Let’s not forget that we’re also feeding in all our code into OpenAI Codex.
  • nodesocket 4y ago
    Which I assume also means sensitive code that may be .gitignore but being pushed up to OpenAI. I.E. secrets, passwords, api keys.
  • est 4y ago
    Many people like me like to paste stuff into an editor to strip the formats. And Github Copilot will gather that tiny amount of data to who knows where.
• agloe_dreams 4y ago
  Meanwhile over at Github Copilot... Hahahahahahaha
  • dubbelboer 4y ago
    If you're using Github already then Copilot isn't seeing anything new.
    • agloe_dreams 4y ago
      Correct, but that level of security is expected from GitHub proper, they have all sorts of independent security reviews for their partners. Does all of that exist for Copilot?
      • grepfru_it 4y ago
        Yes
      • mewpmewp2 4y ago
        Do you think Microsoft would dare to have Copilot with any less standards?
        • agloe_dreams 4y ago
          Counter: it already vomits all kinds of licensing issues everywhere, which somehow they didn’t really see coming…so yes?
          • fooster 4y ago
            No it doesn’t.
        • swyx 4y ago
          given widespread stories of how Copilot development was done on a skeleton team (like 6 pple at launch) yes absolutely
  • 4y ago
• bob1029 4y ago
  We published an internal policy for AI tools last week. The basic theme is: "We see the value too, but please don't copypasta our intellectual property until we get a chance to stand up something internal." We've granted some exceptions to the team responsible for determining how to stand up something internal. Lots of shooting in the dark going on here, so I figured we would need some divulgence of our IP against public tools to gain traction.
  • meghan_rain 4y ago
    Inform us when you figured out a way to host something with the quality of ChatGPT internally :-)
    • bob1029 4y ago
      Even if we had a 100% private ChatGPT instance, it wouldn't fully cover our internal use case. There is way more context to our business than can fit in 4/8/32k tokens. Even if we could fit the 32k token budget, it would be very expensive to run like this 24/7. Fine-tuning a base model is the only practical/affordable path for us.
      • cmelbye 4y ago
        You can retrieve information on demand based on what the user is asking, like this: https://github.com/openai/chatgpt-retrieval-plugin https://github.com/openai/chatgpt-retrieval-plugin
    • visarga 4y ago
      You can use chatGPT inside Azure, like any other service. It's not the same one used by OpenAI, and there are different guarantees. > ChatGPT is now available in Azure OpenAI Service https://azure.microsoft.com/en-us/blog/chatgpt-is-now-available-in-azure-openai-service/ https://azure.microsoft.com/en-us/blog/chatgpt-is-now-availa...
      • meghan_rain 4y ago
• brightball 4y ago
  This was my first concern when it came to IDE plugins.
• yawnxyz 4y ago
  I think there's more fear of OpenAI leaking data than say, Airtable or Notion or Github or AWS/S3 or Cloudflare or Vercel or some other company that has gobs of a company's data. Microsoft also has gobs of data: anything on Office and Outlook is your company data — but the fear that they'll leak (intentional or accidental) is somehow more contained. If we want to be intellectually honest with ourselves, we can either be fearful and have a plan to contain data from ALL of these companies, OR, we address the risk of data leaks through bugs as an equal threat. OpenAI uses Azure behind the scenes, so it'll be as solid (or not solid) as most other cloud-based tools IMO. As for your data training their data: OpenAI is mostly a Microsoft company now. Most companies use Microsoft for documentation, code, communications, etc. If Microsoft wanted to train on your data, they have all the corporate data in the world. They would (or already could!) train on it. If there's a fear that OpenAI will train their model on your data submitted through their silly textbox toy, but NOT through training on the troves of private corporate data, then that fear is unwarranted too. This is where OpenAI should just get a "corporate" tier, charge more for it, and is basically make it HIPAA/SOC2/whatever compliant, and basically do that to assuage the fears of corporate customers.
  • rrdharan 4y ago
    1. Azure has the worst security of the major cloud providers; multiple insanely terrible RCE and open readable DB exposures. 2. Azure infrastructure still likely has far better security/privacy by virtue of all their compliance, (HIPAA, FedRAMP, ISO certifications etc.) than whatever startup-move-fast-ignore-compliance crap OpenAI layers on top of it in their application layer.
  • philwelch 4y ago
    For most of those tools you can get your own self-hosted version if you’re worried about your data.
  • krisoft 4y ago
    > I think there's more fear of OpenAI leaking data than say, Airtable or Notion or Github or AWS/S3 or Cloudflare or Vercel or some other company that has gobs of a company's data. There is zero fear. OpenAI openly writes that they are going to use ChatGPT chats for training. On the popup modal they show you when you load the page. That is not a fear, that is a promise that they will do leak it whatever you tell them. If i tell you “please give me a dollar, but i warn you you will never see it again” would you describe your feeling over the transaction as “fearful that the loan won’t be repaid”?
• crop_rotation 4y ago
  In my experience most corporate employees just take the path of least resistance. It is not uncommon for people to paste non public data into websites just to do json formatting, and paste base64 strings to random websites just to decode them. So just telling people not to do something won't accomplish much. Most corporate employees also somehow think they know better than the policy. Any company that doesn't want to feed data into ChatGPT should need to proactively block both ChatGPT and any website serving as a wrapper over it.
  • japhyr 4y ago
    > and any website serving as a wrapper over it I agree this would be a good move, but it's going to be harder and harder to do that definitively.
    • sophiabits 4y ago
      Perhaps we need an “LLM Block” browser extension? :)
  • itronitron 4y ago
    A while back I got to hear about how the IT team running my then-employer's internal time reporting tool was sending all the usage data through Google Analytics and how neat that was for them to look at :\ . I shudder to think what they are doing now.
    • mewpmewp2 4y ago
      I am not sure I see the issue here?
• dougb5 4y ago
  Given that they use all the labor of the Internet without attribution, we should assume that they will use every additional drop of data we give to them for their own ends.
  • ChatGTP 4y ago
    This is what I hate about it.
• DoingIsLearning 4y ago
  Funnily enough I wrote a cautionary comment on this just 2 days ago : https://news.ycombinator.com/item?id=35299695 https://news.ycombinator.com/item?id=35299695
• syntaxing 4y ago
  I’m curious if anyone’s employer has set up their own LLM. My employer has a couple of A100 sitting around which could easily host a couple instance of 65B LLaMA or Alpaca. Convincing upper management to allow me is the hard part.
  • tiborsaas 4y ago
    Team up with someone from sales, marketing :)
  • AnthonyMouse 4y ago
    I just run it on my desktop? 64GB of DDR4 is <$150.
    • syntaxing 4y ago
      I'm assuming a quantized version?
      • AnthonyMouse 4y ago
        The 65B quantized model fits in 64GB of RAM, which I already had. Though RDIMMs on eBay are even cheaper than UDIMMs (just over $1/GB) and Broadwell-era Xeon workstations aren't that expensive if you want to run the unquantized version.
  • swyx 4y ago
    what on earth do you need to convince them apart from gestures at all this
• Mizoguchi 4y ago
  "In one case, an executive cut and pasted the firm's 2023 strategy document into ChatGPT and asked it to create a PowerPoint deck." There's really not much you can do here. This is complete lack of very basic common sense. Having someone like this in your business, particularly at the executive level, is a liability regardless of ChatGPT.
• yellow_postit 4y ago
  This cycle happens regularly and it seems often times the service provider wises up and charges for extra controls. Yammer pre-Microsoft and nowadays Blind — lots of “insider” information seemingly posted. As usage goes up the target size, and opportunity cost, both go up.
• NoZebra120vClip 4y ago
  This is nothing new at all. How many people have Grammarly plugins installed? They are advertising aggressively, so I'd think it is the new hotness. Don't tell me Grammarly is not hoovering up all of the Slack, Word, Docs, and Gmail data that everyone sends it, and holding on for some future purpose. We'll see.
  • belter 4y ago
    2017... "Grammarly Vulnerability Allows Attackers To See Sensitive Data of Their Customers" - https://www.invicti.com/blog/web-security/grammarly-vulnerability-cloud-based-service/ https://www.invicti.com/blog/web-security/grammarly-vulnerab...
  • sophiabits 4y ago
    Grammarly is an OpSec nightmare that’s somehow managed to slip under most people’s radar. I know folks who won’t use the Okta browser extension because of the extensive permissions it asks for, but will happily use Grammarly on everything. Last time I looked (maybe things have improved…?) Grammarly would automatically attach itself to any text box you interacted with, and immediately send all of your content to their servers for processing. How this software gets past IT departments is a mystery to me.
• johntiger1 4y ago
  It's alright, I just told it that I don't consent to my data being used. Checkmate openAI!
• satvikpendem 4y ago
  I noticed this too, this is why I'm working on a startup that lets you train your data internally through a self-hosted OSS LLM product. It's going to start off with just reading emails for now until we can integrate with other products too, like spreadsheets, Airtable, databases, etc. Basically an OSS version of OpenAI ChatGPT plugins, I suppose. If you're interested, message my at my email in my profile.
• baxtr 4y ago
  We went pretty quickly from: No way I’m giving Google any of my data! I will use 5 different browsers in incognito mode and never log in. To -> Sure I will login with my name and email and feed you as much of my most personal thoughts and data as I can dear ChatGPT!
  • grammers 4y ago
    Not quite. These are the same people that use only Chrome while being logged in to their Google account. Convenience wins.
    • smt88 4y ago
      > These are the same people that use only Chrome while being logged in to their Google account This situation is much dumber than that. ChatGPT is very clear that you shouldn't give it private data and that anything you type into it can/will be used for training. Google is nowhere near that level of transparency.
  • contravariant 4y ago
    Any examples where those two were the same person? Because both types of people have always existed. Heck, lack of vigilance among the ancient Greeks is what put the Trojan in Trojan horse.
    • smodo 4y ago
      It was a lack of vigilance among the Trojans, actually. The Greeks did the burning an pillaging. So uh OpenAI is the Greeks, ChatGPT is the horse and Microsoft is king Menelaos or something. Achilles is dead, but he did make TempleOS.
    • croes 4y ago
      I bet you find some on HN. Sometimes couriosity beats caution.
      • tintedfireglass 4y ago
• robbywashere_ 4y ago
  The real innovation of chatgpt will be how you go about getting permission to use it from your corpo middle management overlords.
• cloudking 4y ago
  ChatGPT Business Edition seems pretty obvious and I'd surprised if OpenAI isn't already working on it. Separate models for each customer, data silos and protection. The infra is already there on Azure.
  • repler 4y ago
    It actually is on Azure, exactly as you described. https://learn.microsoft.com/en-us/azure/cognitive-services/openai/ https://learn.microsoft.com/en-us/azure/cognitive-services/o...
    • cloudking 4y ago
      Yep, they just need to provide a business specific frontend chat UI.
      • daydream 4y ago
        MS already announced that. They call it Business Chat. https://blogs.microsoft.com/blog/2023/03/16/introducing-microsoft-365-copilot-your-copilot-for-work/ https://blogs.microsoft.com/blog/2023/03/16/introducing-micr... If it works well it will be a big deal.
• tombert 4y ago
  This is scary, but it doesn't surprise me even in the slightest. ChatGPT is useful for so many things that it's extremely tempting to convince yourself that you should trust it. For example, I was having some issues with my LTO-6 drive recently, and I had to finagle through a bunch of arcane server logs to diagnose it. I had the idea of simply copypasting the logs into ChatGPT and having it look at them, and it quickly summarized the logs and told me what things to look for. It didn't directly solve the problem, but it made the logs 100x more digestible and I was able to figure out my problem. It made a problem that probably would have taken 2-3 hours of Googling take about 20 minutes of finagling. I'm not doing anything terribly interesting or proprietary on my home server, so I didn't really have any reservations sharing dmesg logs with it, but obviously that might not be the case in a company. Server logs can often have a ton of data that could be useful for a competitor (whether it should be there or not), and someone not paying attention to what they're pasting into ChatGPT could easily expose that data.
• nemo44x 4y ago
  Looking forward to AI on chip not too far down the road. As long as we use APIs for the model itself we can't really use it for much.
• buzzscale 4y ago
  This is one of the reasons Databricks created Dolly, a slim LLM that unlocks the magic of ChatGPT. A homegrown LLM that can tap into/query the datasets of all the data in an organizations Data Lakehouse will be hugely powerful. I am working with customers that are looking to train a homegrown LLM that they host and have blocked access to ChatGPT. https://www.datanami.com/2023/03/24/databricks-bucks-the-herd-with-dolly-a-slim-new-llm-you-can-train/ https://www.datanami.com/2023/03/24/databricks-bucks-the-her... https://news.ycombinator.com/item?id=35288063 https://news.ycombinator.com/item?id=35288063
  • ngngngng 4y ago
    This reads like you had an LLM write an ad for you
• wantsanagent 4y ago
  We saw these same fears with the release of Gmail. Why would you trust your email to Google?!! Aren't they going to train their spam filters on all your data? Aren't they going to sell it, or use it to sell you ads? Corporations constantly put their most sensitive data in 3rd party tools. The executive in the article was probably copying his company strategy from Google docs. Yes, there are good reasons for concern, but the power of the tool is simply too great to ignore. Banning these tools will go the same way as prohibition did in the US, people will simply ignore it until it becomes too absurd to maintain and too profitable to not participate in. Companies which are able to operate without these fears will move faster, grow more quickly, and ultimately challenge companies restricted to operate without. Now I think the article should be a wake-up call for OpenAI. Messaging around what is and what is not used for training could be improved. Corporate accounts for Chat with clearer privacy policies would be great and warnings that, yes, LLMs do memorize data and you should treat anything you put into a free product on the web as fair game for someone's training algorithm.
  • jackson1442 4y ago
    I think this is different in that ChatGPT is expressly using your data as training in a probabilistic model. This means: * Their contractors can (and do!) see your chat data to tune the model * If the model is trained on your confidential data, it may start returning this data to other users (as we've seen with Github Copilot regurgitating licensed software) * The site even _tells you_ not to put confidential data in for these reasons. Until OpenAI makes a version that you can stick on a server in your own datacenter, I wouldn't trust it with anything confidential.
    • wodenokoto 4y ago
      Well, you can stick it on Azure.
    • hgsgm 4y ago
      Google had all the same problems, until it found a balance of functionality, security, and privacy. OpenAI just hasn't started to try adding privacy and security yet.
• jcims 4y ago
  The wild thing is that you can just annotate the content with the associated organization information then ask GPT to tell you what it sees in the logs.
• nbzso 4y ago
  OpenAI. The heist of the century. I am waiting for A.I. generated blockbuster in the near future.
  • yieldcrv 4y ago
    I was just watching Altman's interview from the Lex Friedman podcast a few days ago It really does feel like YC was a plot to fund the harvesting of all with an OpenAI climax. Not a serious conclusion I have, its just funny to watch it unfold, as if nobody even cares about the optics.
• Rzor 4y ago
  First thing that went through my mind as I read the headline was Zuckerberg comments on people posting their info on Facebook.
• jedberg 4y ago
  No one cares about security because there is no consequence for getting it wrong. Look at all the major breaches ever. And look specifically at the stock price of those companies. They took small short term hits at best. Worst case the CISO gets fired and then they all play musical chairs and end up in new roles. Heck, even Lastpass, ostensibly a security company, doesn't seem particularly affected by their breach. My point is, especially with ChatGPT, where it can reasonably 10x your productivity, most people will be willing to take the risk.
  • faeriechangling 4y ago
    I don't even agree to begin with the idea that a tool that vastly increases your productivity is a security risk in the grand scheme of things, since you know, you can just allocate the time you were spending before on writing boilerplate towards securing systems. Endpoint security software is a security risk too.
    • MattPalmer1086 4y ago
      Yikes! Aside from the fact that nobody will take the "spare" time saved and spend it on internal security, once you have a lot of your sensitive data outside in a third party system you have lost control.
      • faeriechangling 4y ago
        > nobody will take the "spare" time saved and spend it on internal security Well I have so speak for yourself. > once you have a lot of your sensitive data outside in a third party system you have lost control. Every time you search “how do I do this with this software stack” in Google you are leaking data which is nominally sensitive to a third party system. Every time a technical staff member goes to stackoverflow without obscufating their IP address they are leaking sensitive data about what software stacks a company uses. Let’s not even get into people posting their resumes on LinkedIn or cloud services in general. The goal of security is not to stop all data leakage, it’s to stop the leakage of certain high value data, and LLMs can aid in this end if you use them intelligently and avoid leaking any high value data to them and only feed them with low value data. Attackers are not going to have any qualms about using LLMs both to come up with attacks and as part of attacks. Many many people are in situations where using LLMs to advance in security maturity as quickly as possible is more than worth the risk incurred. Don’t win the battle, win the war.
• interstice 4y ago
  Could there be eg a browser extension for scrubbing sensitive data from input on paste? I'm hoping OpenAI will implement something like this on their end soon like data monitoring apps do (sentry etc), but if they don't client-side is an option.
• deleted 4y ago
  [deleted]
• bradgessler 4y ago
  Apple will make a killing if they can deploy private LLMs to their M-series chips.
• reneberlin 4y ago
  just because your code is art of course, which should be weighted in gold and copyrighted for the next 2000 years living in a cold wallet. Did you get that memo, that humans implemented all the faulty security that lasted the past decades by accident?
• balls187 4y ago
  And what percent of employees send sensitive information via unencrypted email?
• deltree7 4y ago
  Classic fearmongering article targeted to HN crowd. i) In this world, there are very few people whose private conversation is worth anything to anybody (celebrities, journalists -- so around 10,000 people) ii) A tiny tiny %age of information is truly secret (mostly private keys). iii) Business strategies are mostly a result of execution, not any 'trade secrets'. Meta will succeed because it has executed it's metaverse strategy, not because they kept the metaverse strategy secret. People who take risks and not care about irrelevant details (just like how they took risk with internet shopping, cloud, SaaS) will win. Losers like the ones who thought AWS will steal their data will be left behind
• danielmarkbruce 4y ago
  Seems like a temporary problem. Surely OpenAI will have a version which runs in a customers public cloud VPC, orchestrated by OpenAI.
• twblalock 4y ago
  If you think this is bad, imagine what JSONLint has seen over the years.
• WhereIsTheTruth 4y ago
  That's why privacy is important in the real world Imagine if everyone knew your inner secrets just by looking at you at the bar.. Why is it different online? i have no idea.. well i kinda know but.. oh well.. we deserve it i guess
• phn 4y ago
  Employees have been feeding sensitive data to online translators in the same way. Not to say it isn't a problem, but it's not an AI/chatGPT specific one.
• VLM 4y ago
  I believe there were FUD pieces like this when internet search engines were rolled out, and again when social media became popular. I suppose its universal for new technologies. I had an interview awhile ago at a place where during the phone screen "they can't talk about their tech stack in detail" so I looked on linkedin and figured out their entire tech stack before on the onsite interview. Come on guys, according to linkedin, you have an entire department of people doing AWS with Terraform and Ansible, you don't have to pretend you can't say it in public.
• EGreg 4y ago
  Why don’t people just copypaste all their proprietary code to ChatGPT lol. And maybe send all their artworks to DALL-E. Then good luck trying to sue them for remixing your stuff
• javajosh 4y ago
  Yep. I've been playing with it only in a Stack Overflow way for this reason. I would certainly not mention my personal proclivities or ask it to generate a new password for me. That might be appropriate for a locally hosted model, depending on how secure you can keep it.
• derekhsu 4y ago
  Good point. And why don't you just unplug your computer and do all your stuff on your paper and pen? I believe it's the most secure way to protect your data. Remember to store these paper in your basement and bring your key.
• kjgkjhfkjf 4y ago
  Are we similarly concerned about people posting company secrets on the Korean website/app "Blind" on a daily basis?
• bobse 4y ago
  All information should be free, chuds.
• temporallobe 4y ago
  This should be treated like any other data breach and employees should be reprimanded accordingly, especially for breaches of classified data (not sure if that ever happened, but I’m sure some dumbass has tried it).
• jerkstate 4y ago
  my understanding of GPT is that the only vector for your data to get "into the model" is if it's used in fine tuning/RLHF. My guess is if you do the thumbs up or thumbs down, the session probably will be, but otherwise probably not. Still wouldn't put in private employer data primarily because of the other exposure risks - it's obviously not stored securely on the OpenAI side. But besides typical IT risk, the big unknown is whether or not the model will spit out what you put into it in somebody else's session. and my understanding is, that's only possible if your conversation is used for RLHF. I guess another way to say that is, OpenAI (or another service provider with a better security track record) could broker this service in the cloud, with guarantees around not using the session data for RLHF, not storing session data, stronger auth (OpenAI has had a couple of incidents that show that they have pretty lax security in their backend), etc. and could make a killing selling or re-selling ChatGPT to businesses.
• waldenyan20 4y ago
  It seems like an enterprise product is going to have a market here.
• jacquesm 4y ago
  For fun I once just made a blank from with a submission button and a giant text field. It was quite amazing what people would submit unprompted, so I'm not at all surprised that people would feed sensitive data into ChatGPT. The next cycle will be that ChatGPT gets - surprise - trained on that data, and may start using fragments of it - which may well still be sensitive enough to cause trouble - as its output. Don't paste confidential information into a textbox, in fact don't trust anybody or any company with your confidential information unless there is a strong contractual relationship backed up by penalties if it gets broken. And even then: the ultimate responsibility is yours, you may be able to recover some $ for damages but your reputation may well be toast.
• ryanSrich 4y ago
  What’s not clear from OpenAI is what they actually store. Clearly they store information from ChatGPT, but if I hit their chat/completions API with the same exact question do they store that as well?
• danjc 4y ago
  You know what's hilarious about this - they quote specific examples of information that was prevented from being sent to ChatGPT. Someone at Cyberhaven is reviewing the requests it blocked.
• patal 4y ago
  How do you feed sensitive data to ChatGPT? I've got no account, therefore no idea. I thought you just ask it questions, or task it to write some code. How does the sensitive data get there?
  • maigret 4y ago
    - Translate this upcoming announcement in Spanish - Can you summarize that product roadmap? - Can you add comment to this piece of (proprietary) code? - Please extract the birth dates from this employee list I could go on and on and on
    • patal 4y ago
      I see. Thanks.
• larsonnn 4y ago
  I bet they post sensitive data to all platform which may help them. Also I guess chat with Microsoft teams or slack is ok.