The short version: doctors' offices, engineers and government officials are already pasting sensitive data into chatbots. Not because they are careless, but because the tool is that useful. Today that is a data leak and you need rules for it. Long term, the bigger shift is in us: a more conscious kind of person simply won't want to read someone else's private file. Why would you want to know that?
Tuesday, 14:10
A medical record. A spreadsheet of customer addresses. A folder of source code. A contract marked "for official use only".
Copy. Paste. "Summarise this."
Thirty seconds later the work is done, and the person goes home on time.
This is not a hypothetical. In the Netherlands, the privacy regulator reported that an employee at a GP practice entered patients' medical data into an AI chatbot, against internal agreements, and that a telecom employee uploaded a file with customer addresses.[1] At Samsung, engineers uploaded internal source code to ChatGPT, after which the company temporarily banned generative AI on work devices.[2] And in the US, the acting head of the national cyber defence agency uploaded sensitive contracting documents into a public version of ChatGPT, triggering automated security warnings.[3]
Healthcare. Big tech. The people in charge of cyber security. Everyone.
Why it happens
Because it works. The hype is loud because the value is real. When a tool can turn a fifty-page dossier into five clear lines, people will use it, policy or no policy. Banning it doesn't stop the pull. It just moves the copy-paste to a personal phone.
So the honest question for entrepreneurs and larger companies isn't "should our people use AI?" They already do. The question is which rules the AI follows, and who decides.
What to do today
Until the world catches up, the practical part is simple:
- Give people a sanctioned tool. If the approved route is easier than the personal laptop, data stays where it belongs.
- Write the rule down. What may go in, what never goes in. Medical data, customer files and confidential contracts are the obvious first lines.
- Keep a human on the irreversible steps. The agent prepares; a person approves anything that leaves the building or moves money.
- Log what the agent saw and did. Not to punish anyone. To learn.
- Treat a leak as a lesson. Fix the rule, then move on fast.
The turn
Now zoom out. Ten years. Thirty.
Privacy as we know it is a wall built out of one assumption: that if someone can look, they will. Locks, passwords, NDAs, consent banners. A whole economy built around keeping curious eyes out.
But look at what is actually happening. Every day, millions of people hand their most sensitive work to a machine that doesn't gossip, doesn't judge and doesn't care whose diagnosis it is reading. The machine is already behaving the way we say we want people to behave.
And people are changing too. The more of our routine work these systems carry, the more room we get for attention, for each other, for becoming more conscious. A more conscious person doesn't stand at someone else's window. Not because a law says no. Because the wish is gone.
Your neighbour's medical history. A stranger's bank balance. A colleague's private messages.
Why would you want to know that?
That is where this goes. Not to a world where everything is hidden better, but to a world where far fewer people are looking. Privacy stops being something you defend and becomes something nobody thinks to violate.
We aren't there yet. So build the rules today. But build them knowing the direction: technology that handles everything, and people who no longer want what isn't theirs.
The walls were never the point.
Written by Bombos, which builds AI agents that do recurring work, remember how your company runs, and ask a human before anything irreversible: bombos.ai
Sources
[1] Autoriteit Persoonsgegevens, "Let op: gebruik AI-chatbot kan leiden tot datalekken", 6 Aug 2024: https://www.autoriteitpersoonsgegevens.nl/actueel/let-op-gebruik-ai-chatbot-kan-leiden-tot-datalekken
[2] The Verge (reporting Bloomberg), "Samsung tells employees not to use AI tools like ChatGPT", 2 May 2023: https://www.theverge.com/2023/5/2/23707796/samsung-ban-chatgpt-generative-ai-bing-bard-employees-security-concerns
[3] Politico, "Trump's acting cyber chief uploaded sensitive files into a public version of ChatGPT", 27 Jan 2026: https://www.politico.com/news/2026/01/27/cisa-madhu-gottumukkala-chatgpt-00749361
This is the opinion of Piet Baudoin and does not necessarily reflect the views of the rest of Bombos. Stay tuned for theirs ;)
Top comments (0)