The Most Valuable Data in Your AI Stack Is the Stuff You Fed It

Four stories landed on the same day this week, and they're all the same story.

"Exfiltrate Your Weights" hit the front page — a whole class of attack aimed at lifting a model's weights out of a running service. "Pirate Face Rescues LLM Models from Deletion" — a project whose entire job is saving models before a vendor quietly deletes them. A report that ChatGPT now knows what you do on other websites through an embedded ad collector. And Spain ordering blocks on Archive.today and its mirrors.

Not one of these is about whether AI is smart. All four are about data moving in a direction nobody authorized — out of a vendor, into a vendor, or off the face of the internet entirely.

Your prompt box is a two-way pipe

When you paste a supplier quote, a customer's address, or your margin sheet into an AI tool, you're thinking about the answer coming back. You should be thinking about the trip it took.

That data can be logged, used for training, observed by a third-party SDK, or subpoenaed. The ad-collector story is the unglamorous version of this: no dramatic breach, just a quiet pipe you never agreed to. For a cross-border seller, "the data" is a customer's national ID, a shipping address, a refund record — the exact material that turns a compliance fine into a business-ending one.

The rule is boring and it works: treat every AI tool as a public channel. If you wouldn't paste it into a public forum, don't paste it into a prompt. Anonymize before you send, and resolve identities on your own systems, not in someone else's context window.

Your weights — and your vendor — can walk out the door

"Weights exfiltration" sounds exotic until you translate it. Weights are the product. If they can be lifted, cloned, or poisoned, your "moat" was never a moat — it was a lease.

Then there's the quieter risk: deletion. A model you built workflows around can be deprecated, gated, or pulled in a single update. The rescue project exists precisely because that happens often enough to need a rescue project. Spain blocking an archive is the same lesson one layer up — access you depend on can be revoked by a government, a vendor, or a bad quarter, with no notice and no appeal.

Design the exit before you design the workflow

The durable move is not to pick a more trustworthy vendor. It's to assume none of them are permanent:

• Inventory what flows out. For each AI tool, list the sensitive fields that leave your control. If the list is long, shrink the list.
• Keep a local copy of everything that matters. Prompts, outputs, fine-tuned weights, decision logs — if you can't reproduce it without the vendor, you don't own it.
• Assume exit is a feature, not a failure. Pick tools whose data you can export in a format you can actually use. Test the export before you need it.
• Put a human on the irreversible. Data deletion, model updates, permission changes — anything you can't undo gets a checkpoint.

A model that can be lifted, watched, or switched off is not a foundation. It's a dependency. The businesses that survive the next vendor shakeup won't be the ones with the smartest model — they'll be the ones who assumed the model was a renter, and kept the deed to their own data.

Feed it less. Own what you feed it. Plan the exit while you still have the option.