Two Incidents, One Pattern
In April 2023, Samsung Semiconductor disclosed 3 separate data leaks through ChatGPT inside 20 days. Engineers pasted proprietary source code, confidential meeting notes, and internal test sequences into a public LLM. Samsung banned ChatGPT company-wide. Engineers kept using it on personal devices.
In 2025, Notion workspace data reached third-party model servers through an AI assistant misconfiguration. Customer workspace content, including engineering docs and internal pricing models, was processed by providers whose data processing agreements covered other content types.
Different companies. Different tools. Same root cause. Same fix.
This teardown walks through what happened, why policy alone fell short, and what AI code leak prevention actually requires.
Samsung: 3 Leaks in 20 Days Leak 1: A Samsung engineer pasted proprietary semiconductor source code into ChatGPT to debug an error. The prompt, including the full source, was retained by the provider for training purposes.
Leak 2: An engineer pasted internal test sequences for chip validation to ask ChatGPT for optimization advice. The sequences revealed the exact defect patterns Samsung tested for in production silicon.
Leak 3: An engineer pasted the transcript of an internal recorded meeting to generate meeting minutes. The transcript contained product roadmap discussion and competitive analysis.
Samsung disclosed the incidents internally. They banned the tool. Bloomberg reported the numbers. Samsung then built an internal ChatGPT clone.
The ban fell short. A TechCrunch follow up found engineers were still using the public tool through personal accounts and personal devices. The data was gone the moment it was pasted, and policy had already run out of reach.
Notion: The Assistant Misconfig
Notion integrated a third-party AI assistant for workspace summarization and content generation. The integration routed workspace content through a model provider that Notion had vetted for customer-facing use and left open in scope.
Workspace admins who enabled the assistant were unaware that enabling it gave the provider access to every page the assistant was asked about. Enterprise customers found internal strategy docs and engineering plans had been sent outside their data boundary.
Notion issued a post mortem. They tightened the integration scope. For customers who had enabled the feature during the affected window, content that had already been sent stayed out of reach for recovery.
The Common Root Cause
Both breaches share a single cause: proprietary data entered an LLM API call with an empty gap where an enforcement layer belonged, between the user and the provider.
Samsung had a policy. The policy said keep source code out of public LLMs. The engineers knew the policy. They pasted the code anyway because the tool was useful and the policy was a document, while what they needed was a control.
Notion had a vendor review process. The process approved the AI provider. The process missed that the integration scope was broader than the review assumed. Policy that lacks technical enforcement is a wish list.
This is the pattern across every AI code leak we have tracked. The 2025 LayerX Security report found 40 percent of files uploaded to ChatGPT contained PII or PCI data. The 2026 CISA disclosure found officials used ChatGPT for sensitive government work. Policy alone fails every time; enforcement is what holds.
Why Bans Make It Worse
Samsung banned ChatGPT. Engineers switched to personal accounts on personal devices. The company lost visibility. Before the ban, the ChatGPT traffic was at least traceable on corporate network logs. After the ban, it moved to home Wi-Fi.
This is called shadow AI. A Gartner survey found 63 percent of enterprises that banned consumer AI tools discovered employees using them anyway within 90 days. The ban moves the risk somewhere harder to see; guarded adoption shrinks it.
The working control is a technical one. Intercept the API call. Transform the payload while it is still on the machine. Produce an audit log.
What Mutation Does
Pretense mutates proprietary identifiers before the API call is made. The LLM sees only stand-ins. If the provider is breached, if the API logs are subpoenaed, if the model is trained on the traffic, the leaked data is synthetic stand-ins in place of your source code.
Samsung pastes getDefectPattern into the prompt. Pretense rewrites it to _fn7a2c while the request is still on the developer laptop. The LLM answers in synthetics. Pretense swaps the identifier synthetics back to real names, byte-exact, in the response. Any secrets or credentials in the prompt stay as stand-ins in the answer by design. The developer gets working output. The provider sees only the stand-in identifier.
This is mutation, a different approach from redaction. Redaction-based tools strip information and break the output. Mutation preserves structure and preserves utility. The output quality stays within measurement noise of an unprotected request.
The Audit Trail
The second thing Samsung and Notion both lacked: an audit trail. When the leak was discovered, both teams struggled to answer basic questions quickly.
- -Which identifiers left the building? - Which developers made the requests? - Which projects were affected? - What time window was the exposure?
Pretense logs every mutation with timestamp, file path, identifier, synthetic hash, model, and user. Run pretense audit and the answer is immediate. Export the log as CSV for SOC2 evidence. The audit trail is the artifact that turns a security event into a closeable ticket.
What AI Code Leak Prevention Requires
Based on these 2 teardowns plus the 6 incidents we have tracked across 2024 to 2026, AI code leak prevention requires 4 properties:
- -Intercept at the API boundary, the place users actually pass through. Users route around policy. A proxy sits on the path they have to take. 2. Mutate, keep the structure. Redaction destroys output quality and drives users back to unprotected tools. 3. Local-first map. The mutation key stays on your machine. The whole system depends on it. 4. Audit log by default. You can respond to a breach once you can describe it.
A tool missing any 1 of these is a speed bump; a firewall has all 4.
The Lesson
Samsung lost chip design IP to a policy gap. Notion lost workspace data to a scope gap. In both cases, the gap was the same: an absent enforcement layer between the user and the LLM API.
The tools that exist today close this gap. Pretense is open source, deploys in 30 seconds, and generates the audit log your compliance team will need when the next incident lands.
Assume your team is already pasting proprietary code into an LLM; that is happening right now. The question that matters is whether the API traffic that leaves your network carries real identifiers or synthetic stand-ins.
