Your employees are pasting secrets into ChatGPT. Here's what leaks — and how to stop it

In April 2023, Samsung engineers pasted proprietary source code and internal meeting notes into ChatGPT while debugging and summarizing. The incident made headlines because it was Samsung, but the behavior it exposed is universal: give people a tool that turns messy input into finished output, and they will feed it whatever is on their screen — including things that were never supposed to leave the building.

Three years later, the tools have multiplied — ChatGPT, Claude, Gemini, Copilot, Perplexity — and the paste habit has only deepened. Security teams that instrument paste events consistently find that a meaningful fraction of employees have submitted confidential material to an AI tool, usually without realizing they did anything wrong. The employee is not malicious. They are debugging a stack trace that happens to contain a database connection string, or summarizing a customer email thread that happens to contain an account number.

This post breaks down what actually leaks, what happens to it after the paste, why the obvious countermeasures fail, and what an effective control looks like.

What actually gets pasted

The leaks cluster into a handful of categories, and each one arrives through a legitimate workflow:

• Credentials and API keys. Developers paste code and configuration for debugging or refactoring. Stack traces, .env fragments, and curl commands routinely carry AWS keys, Stripe secret keys (sk_live_...), GitHub tokens, and database passwords.
• Customer PII. Support and sales teams paste ticket threads and CRM exports to draft replies or summaries. Names, emails, phone numbers, and addresses ride along by default.
• Financial data. Finance teams paste spreadsheets and invoices for analysis. Card numbers, bank account details, and unreleased revenue figures are common passengers.
• Health information. Anyone in a healthcare-adjacent role who pastes a patient note or claims record into a consumer chatbot has potentially disclosed PHI — a regulatory event, not just a privacy one.
• Source code and internal documents. Strategy memos, contracts under NDA, and proprietary algorithms — pasted because "summarize this" and "improve this" are exactly what these tools are best at.

Where a pasted secret goes

Once submitted, the text leaves your control in several ways at once. It sits in the conversation history of a personal account your company cannot audit or wipe. Depending on the tool and the account tier, it may be used to train future models — consumer tiers often default to training on conversations unless the user opts out. It is retained on the provider’s servers under a retention policy you did not negotiate, and it becomes discoverable in any breach or legal process that touches the provider.

For credentials specifically, the calculus is simpler: a secret that has been transmitted to a third party is compromised. The correct response to a pasted API key is rotation, and most organizations have no way to know a rotation is needed, because they never saw the paste.

Why the obvious fixes fail

Blocking AI domains at the firewall is the reflex, and it fails predictably. Employees switch to phones, home machines, or the dozens of AI tools your blocklist has not caught up with — you lose all visibility while the behavior continues. Blanket bans also carry a real productivity cost, which is why most of them get quietly reversed within a quarter.

Policy documents alone fail for a different reason: the violation is invisible at the moment it happens. Nobody reviews a paste. An acceptable-use policy with no enforcement mechanism is a memo, and memos do not compete with deadlines.

Traditional DLP suites fail on mechanics — they watch email, file transfers, and endpoints, but a paste into a chat textarea on an HTTPS page is invisible to most of them. That gap is big enough that we wrote a separate deep-dive on it.

Stop the paste before it becomes a prompt

The only place you can inspect a prompt with full fidelity — and still act before disclosure happens — is inside the browser, at the moment of composition. Text sitting in a chat input box has not left the machine yet. Scan it there and three good options open up: warn the user (which resolves most incidents, because most are accidental), redact the sensitive spans and let the rest of the prompt through, or block outright for the categories where policy demands it.

This is the approach ShieldWays takes. A browser extension detects PII, secrets, PHI, and financial data on-device, before prompts are sent to ChatGPT, Claude, Gemini, Copilot, or Perplexity. Detection runs locally — the content never leaves the machine for analysis — and each event lands in a content-free audit log: category, action taken, site, and time, never the sensitive text itself. Security gets the visibility it never had; employees keep the tools they were going to use anyway.

The takeaway

Your employees are already using AI tools, and some fraction of what they paste is sensitive. Bans push the behavior out of sight, policies without enforcement do not change it, and legacy DLP cannot see it. The control that works operates where the leak happens: in the browser, before the prompt is sent. Everything else is cleanup.