Ten Seconds Before You Press Paste

In the spring of 2023, Samsung let engineers at its semiconductor business use ChatGPT to help with their work. Within a few weeks, the Korean outlet Economist Korea reported three separate slips. One engineer pasted in source code from a semiconductor database program and asked for a fix, another asked for help optimizing code, and a third asked the tool to summarize meeting notes. Samsung capped the size of each prompt, and in early May a memo reported by Bloomberg told staff that generative AI tools were off limits on company devices.

The reports describe the leaks as accidental, and it is easy to see how they happened. Each person had a work problem and a chat box that felt like a private conversation with a very quick assistant. Most of us have stood in the same spot with a client email that needs a calmer tone, a spreadsheet that needs summarizing, or a contract clause that makes no sense at nine at night. Those few seconds before you press paste are the cheapest protection you have, and knowing what to look for makes them count.

Why a Chat Box Feels More Private Than It Is

The UK's National Cyber Security Centre, a government agency, published a plain explanation of this in a March 2023 blog post written by two of its technical directors. They explained that a chatbot does not automatically add your question to its model for other people to find later, which is the fear most people carry. The risk sits somewhere else. Your question is visible to the company that runs the tool, it is stored, and the NCSC said it would almost certainly be used at some point to develop the service. The company's staff, partners, or contractors may be able to read it, which is why the post told readers to understand the terms of use and privacy policy before asking anything sensitive.

That post is more than three years old, and the tools have changed since. Most major providers now offer settings that keep your chats out of model training, along with temporary chat modes and business plans with stronger data terms. Settings only cover what the company does with your data, though. They say nothing about what you are allowed to share, which depends on your employer, your clients, and in some fields the law. The NCSC's simple rule still holds up, which is to avoid sending a public tool anything that would cause problems if it became public.

Sensitivity is not only about the words you paste. The NCSC pointed out that a question can be sensitive because of who is asking and when, and gave the example of a chief executive asking how best to lay off an employee. The post also warned about aggregation, meaning that many small questions asked from one login can add up to a detailed picture of a person or a business. Stored chats can be hacked, leaked, or accidentally made public, and a company that runs a tool can later be bought by an organization with a different attitude toward privacy. None of that means you should avoid AI tools, only that a chat history deserves the same care as a folder of work emails.

What Counts as Sensitive Work Information

Sensitive does not only mean secret. It means anything that would cause harm, embarrassment, or a legal problem if the wrong person read it, whether that person is a competitor, a customer, a coworker, or a stranger. The easiest way to spot it is to sort what you are about to paste into a few groups, because most work material falls into one of them. Any single line may look harmless, so check the whole block of text and not only the part you care about. If a piece of text fits in more than one group, treat it as more sensitive, not less.

Information about people. The Federal Trade Commission's guide for businesses lists names, Social Security numbers, and credit card details among the sensitive personal information that companies keep in their files. Add to that home addresses, personal phone numbers and emails, dates of birth, photos, and anything in an employee file such as pay, performance reviews, medical leave, or disciplinary notes. A customer complaint with a full name and order history counts too, and so does a resume from a job applicant. Names alone matter less than the combination, since a name beside an address and an account number is far more useful to a thief than any one of them.

Money and business numbers. Revenue, profit margins, pricing before it is announced, bank details, payroll totals, and investor figures all belong here. Competitors would value some of it, and customers could be upset to see what other customers pay. Even a rough summary such as a forecast for next quarter can reveal more than you intend. If your company has not shared a number publicly, assume it is not yours to share with a tool either.

Passwords and access. Never paste a password, an API key, a security code, a private link to a shared folder, or a screenshot that shows any of them. People often forget that error messages, configuration files, and code snippets can contain keys that were typed in once and left behind. A shared link that lets anyone with the link view a file works like a door with no lock. Once something like that has been pasted, the safe move is to change it, so the better habit is to keep it out of the box in the first place.

Confidential company material. This covers contracts, anything under a nondisclosure agreement, unreleased products, strategy documents, internal meeting notes, and source code. The Samsung cases fit here, because source code and meeting notes feel like ordinary work files until they land in a tool outside the company. Legal and customer documents are especially tricky, since you may be sharing someone else's confidential information along with your own. When in doubt, ask who owns the document, because the owner may not be your employer.

Information you hold for someone else. If you work with clients, patients, students, or members, they trusted you with their details under an agreement or a legal duty. Health records, financial records, and legal matters often carry rules that go well beyond a company's preference, and those rules differ by industry and country. A privacy setting in an app does not change those duties. If you are unsure whether a rule applies, ask your manager, your compliance or legal contact, or your own attorney before you paste anything.

Details hiding inside the file. A document can carry more than what you see on the page. Word files can hold comments and tracked changes from earlier drafts, spreadsheets can have hidden tabs and extra columns, and an email thread can include a long chain of forwarded messages and signatures below the part you meant to share. File names also give things away, such as a client's name or a project code name. Scroll through everything, including the very top and the very bottom, before you attach or paste.

Eight Steps to Take Before You Paste

Each of these steps takes a few seconds once it becomes routine. The first few times, go slowly and treat it the way you would treat checking your mirrors before pulling out of a parking space. Nothing here needs technical skill, only attention. The goal is a habit that runs on its own, so that a paste never happens on autopilot.

Step 1. Find out what your workplace allows. Look for an AI policy or acceptable use policy in your employee handbook, intranet, or onboarding documents, and read the part about outside tools. If you work for yourself, reread your client contracts and any nondisclosure agreements, because those often decide what you can share with a third party. A tool being popular does not make it approved, and Samsung's ban shows how quickly a rule can change after one mistake. If you cannot find a rule, send your manager a short message asking what is allowed, and wait for the answer before you paste work material.

Step 2. Check which account you are signed into. A free personal account, a paid personal plan, and a company account can have very different data terms even when the website looks identical. OpenAI's help pages say that on ChatGPT Free, Plus, and Pro, data sharing is on by default, and that its Team, Enterprise, and Edu plans offer additional data controls. Anthropic's consumer plans (Free, Pro, and Max) follow a setting you choose, while Anthropic says its 2025 consumer update does not apply to commercial products such as Claude for Work and the API. Look at the name or logo in the corner of the screen, and if you use more than one account, make sure the right one is open before you type.

Step 3. Look at the privacy settings before the first paste. On ChatGPT, open your profile, choose Settings, then Data controls, and turn off the switch labeled Improve the model for everyone. OpenAI says your chats will still appear in your history but will not be used to train its models. A Temporary Chat is a separate mode that OpenAI says is not used for training, does not create memories, and is deleted from its systems after 30 days, though it may be reviewed to monitor for abuse. On Claude, consumer accounts have a setting under Settings and Privacy labeled Help improve Claude, and since a policy change in 2025 it decides whether chats can be used for training and kept for up to five years instead of 30 days. Turning a setting off applies to future chats and does not pull back anything already used, and labels move around as companies update their apps, so read the current wording on your screen.

Step 4. Read your text slowly and mark what is sensitive. Before you paste, read the whole passage from top to bottom as if a stranger had written it, and mark anything that belongs to the groups above. Look for names, email addresses, phone numbers, account or order numbers, dollar amounts, company names, project names, and anything that sounds like a plan nobody has announced. The FTC's guide for businesses begins with the idea of taking stock, which means knowing what information you hold and who could see it, and the same idea works at the size of a single paste. If you find something and cannot decide whether it is sensitive, treat it as sensitive.

Step 5. Replace the sensitive pieces with placeholders. Swap each real detail for a plain label in brackets, such as [Client Name], [Invoice Number], or [Amount]. Suppose you want a firm but polite reminder about a late payment. Instead of pasting the client's name, the invoice number, and the dollar figure, you can ask for a reminder to a client about an invoice that is 45 days overdue and tell the tool to leave the bracketed labels in place. When the draft comes back, you type the real details in yourself, on your own device, and the tool never sees them. Keep one consistent label per person or company, such as Client A and Client B, so the answer still makes sense when several are involved.

Step 6. Share only what the task needs. The FTC's second principle for protecting information is to scale down, which means keeping only what you need, and the advice carries over neatly to prompts. If you want help rewording one paragraph of a report, paste that paragraph and not the entire report. If you want a formula fixed, describe the columns in general terms or paste five invented rows that look like your data instead of the real file. A shorter paste is also easier to review, and the answer is often better because the tool has less to wander through. Ask yourself whether the task would still work if you deleted half of what you were about to paste, and delete half if the answer is yes.

Step 7. Check the file or screenshot, not only the text. If you plan to upload a document, spreadsheet, or image, open it first and look for comments, tracked changes, hidden sheets, hidden rows, and details such as the author name and file name. In Word you can review comments and revisions with the review tools, and in a spreadsheet you can unhide sheets from the menu on the sheet tab. For a screenshot, look at the edges, because browser tabs, bookmarks, notification pop ups, and open email previews often sneak in. When a file is complicated, copy only the plain text you need into a fresh document and use that instead.

Step 8. Check the answer before it goes anywhere, and know what to do after a slip. The NCSC noted that these tools can get facts wrong and produce invented details that sound convincing, so verify names, numbers, and claims before anything goes into an email or report. Then put your real details back in and read the final version once more. If you realize that you pasted something you should not have, tell your manager or your IT or security contact right away, since the people who can act on a mistake can do far more when they hear about it early. Delete the chat if the tool allows it, change any password or key that was exposed, and write down what was shared so you can describe it accurately.

Make It a Habit

With practice, the whole routine fits into about ten seconds. You confirm the account, scan the text for names and numbers, swap the details for placeholders, and send only what the task needs. These tools can save hours of work, and none of this asks you to give that up. It only asks that you stay the person who decides what leaves your hands. A conversation with an assistant feels private, and the habit of checking is what keeps that feeling accurate.