# AI Data Exposure > [!abstract] What this note is > The ways information leaves your control when you work with AI tools, mostly without any attacker involved: what you paste, what you share by link, what the assistant remembers, what sits in logs, and what gets published. Part of [[AI Security for Users]]. Sources checked 2026-09-13. ## A share link is a publication In mid-2025 thousands of ChatGPT conversations turned up in Google search results. Users had shared them with an option that made them discoverable, and many hadn't understood what that meant. OpenAI removed the option on 31 July 2025, after about 4,500 chats had been indexed [1]. Weeks later, more than 370,000 shared Grok conversations were found indexed, with no warning to the people who shared them [2]. Treat "share" as "publish". If a conversation contains anything you wouldn't post publicly, don't create a link to it. ## What you paste - **Secrets don't belong in a prompt.** API keys, passwords, recovery codes and client credentials end up in conversation history, and often in logs and exports. - **Other people's information is theirs.** Pasting a client's contract or a colleague's email into a consumer AI tool moves it into a system they never agreed to. - **Check the data settings** for your plan: whether conversations are used for training, how long they're kept, and who in your organisation can see them. They differ between products and between free, paid and business tiers. ## What the assistant remembers Persistent memory makes an assistant more useful and gives it something to leak. It can also be **written to by others**: in February 2026 Microsoft documented websites planting instructions in assistants' memory through "Summarize with AI" buttons [3]. See [[Prompt Injection]]. Open the memory view now and then, and delete anything that is wrong, sensitive, or that you don't remember putting there. ## What sits on your own disk Agent tools keep **session transcripts** locally, and a transcript contains everything the agent read: file contents, command output, credentials that were printed to a terminal. Coding agents will also happily read configuration and environment files if nothing stops them. That makes your machine a richer target. The Nx attack in August 2025 used AI tools already installed on developers' computers to find secrets [4]. Keep secrets in a manager, keep them out of the directories your agent works in, and deny the agent access to credential files. ## Custom assistants leak their setup Instructions and files you give a custom assistant or GPT can often be extracted by anyone who talks to it. OWASP lists this as **system prompt leakage** [5]. Never put credentials, internal pricing, or anything confidential in a custom assistant's instructions. ## Publishing with AI help AI writes fluent documentation fast, and fluent documentation fills with **scaffolding**: folder names, directory trees, file paths, example records, log lines. Those carry proper nouns, such as client names, internal project names and colleagues, that the author may not notice on a read-through. Standard secret scanners look for **patterns**: email addresses, phone numbers, key formats. A client's name matches no pattern. Two things catch it: - **A deny list of the names that must never appear**, checked automatically before anything is published, that fails loudly on a hit. Keep the list itself somewhere private, since a list of your clients is the most sensitive file of all. - **Never inferring what is public from your local tooling.** Version control can say a file is untracked while a separate publishing tool has already put it online. Check the live site. ## Sources 1. [OpenAI removes ChatGPT self-doxing option — The Register, 1 Aug 2025](https://www.theregister.com/2025/08/01/openai_removes_chatgpt_selfdoxing_option/) 2. [xAI published hundreds of thousands of Grok conversations — Forbes, 20 Aug 2025](https://www.forbes.com/sites/iainmartin/2025/08/20/elon-musks-xai-published-hundreds-of-thousands-of-grok-chatbot-conversations/) 3. [AI recommendation poisoning — Microsoft Security, 10 Feb 2026](https://www.microsoft.com/en-us/security/blog/2026/02/10/ai-recommendation-poisoning/) 4. [s1ngularity postmortem — Nx](https://nx.dev/blog/s1ngularity-postmortem) 5. [LLM07:2025 System Prompt Leakage — OWASP](https://genai.owasp.org/llm-top-10/) ## Related - [[AI Security for Users]] — the section overview - [[Prompt Injection]] — memory poisoning and exfiltration - [[The Home System]] — a private vault and a public one, and the check between them