Employees are accidentally leaking company data through ChatGPT, report warns

AI chatbots

As more enterprises adopt generative AI tools such as ChatGPT, Microsoft Copilot, and Anthropic’s Claude to improve productivity, a new report highlights a growing risk: employees are inadvertently leaking sensitive company information. According to Cyera, AI chats have surpassed email and cloud storage as the primary source of workplace data leaks. The issue is particularly concerning because many of these leaks remain unnoticed by corporate security systems.

Research indicates nearly 50 per cent of enterprise employees use generative AI at work. Often, this involves copying and pasting confidential material such as financial records, personally identifiable information, and strategic documents directly into AI chat interfaces. While such data should never be shared with AI, employees frequently do so through unmanaged personal accounts, making interactions invisible to IT security measures. Cyera notes that 77 per cent of AI interactions at work involve actual company data.

Traditional cybersecurity tools are largely ineffective in this context. File attachments, suspicious downloads, and outbound emails are monitored, but AI conversations appear as normal web traffic, even when containing sensitive information. A 2025 LayerX enterprise report found that 67 per cent of AI interactions occur on personal accounts, creating a blind spot for IT teams that cannot monitor or restrict these logins.

Experts emphasise that the goal is not to ban AI outright but to implement tighter controls and better oversight. Recommended measures include blocking access to generative AI via personal accounts, requiring single sign-on (SSO) for all AI tools on company devices, monitoring for sensitive keywords and clipboard activity, and treating AI chat interactions with the same scrutiny as traditional file transfers. Employees should exercise caution, avoiding pasting anything into AI tools that they would not publicly share online.

The report underlines that AI is still relatively new in professional settings. Many employees are learning how to balance productivity benefits with the risks of exposing confidential information. Even a seemingly innocuous prompt such as “Summarise this report for me” could unintentionally compromise a company’s data.

In the race to leverage AI for efficiency, awareness of potential data leaks is crucial. Companies and employees must adopt proactive measures to prevent accidental exposure of sensitive information, recognising that even one careless copy-paste can have serious consequences.