Where data given to cloud AI ends up: three years on the record
This is not a theoretical risk: it happened, it is documented, and none of these cases needed a hacker. Just people doing their jobs, a share button, a database left open, a court order.
The good-faith mistake
Spring 2023, Samsung. Three times in twenty days: semiconductor engineers pasted proprietary source code and the minutes of an internal meeting into ChatGPT — looking for help, like anyone would. The company ended up banning chatbots for all staff (Bloomberg, 2 May 2023). In the same period, professional regulators started to warn: a UK tribunal cautioned lawyers that uploading confidential case files to an open AI platform can breach confidentiality and waive legal privilege; and patient data given to a chatbot leaves the protection of medical secrecy — the AI vendor is not bound by it.
The share button
Summer 2025. "Shared" ChatGPT conversations ended up in Google's index: thousands of chats readable by anyone with a search — addiction, health matters, client data. OpenAI pulled the feature, calling it an experiment that "introduced too many opportunities for folks to accidentally share things they didn't intend to" (TechCrunch, 31 July 2025). A month later it was Grok's turn: hundreds of thousands of shared chats, indexed because the share link did not block search engines.
Somebody else's infrastructure
January 2025, DeepSeek. Wiz researchers found one of the vendor's databases reachable from the internet with no authentication at all: over a million log lines, including users' chat histories and internal keys. It was closed quickly after the disclosure — but anyone who had found it first had everything.
The court
2025–2026. In the New York Times case against OpenAI, the court ordered all conversations preserved — including the ones users had deleted — and in January 2026 upheld the hand-over of 20 million chats to the plaintiffs (Bloomberg Law). In February 2026 a federal judge ruled that documents prepared with a consumer AI are not covered by privilege: some thirty documents of a defendant had to be turned over to the opposing side. In plain terms: what you write to a cloud AI can be retained against your will, and one day read out in a courtroom.
Four different roads — human error, a link, someone else's database, a court order — and a single destination: data, once it leaves, does not come back.
The right question
For a Dominican business — the courier with its clients' IDs and addresses, the clinic with medical records, the accounting firm with other people's numbers — the question is not "is my AI vendor reputable?". It is: does my clients' data need to leave the company at all? When the intelligence sits on a machine in your office — that is how we build Conectao Core — the four roads in this chronicle simply do not exist: nothing travels, nothing gets shared by mistake, nothing sits in someone else's database, nothing can be handed over by a third party. We wrote about the costs here; this is the part that is not measured in pesos.
Sources
Forbes — Samsung bans chatbots after code leak (05.2023) · TechCrunch — ChatGPT chats indexed by Google (07.2025) · Wiz Research — exposed DeepSeek database (01.2025) · Bloomberg Law — hand-over of 20M chats upheld (01.2026) · Harris Beach Murtha — no privilege for consumer-AI documents (02.2026) · ICT&Health — doctors' data in ChatGPT