MODULE 6 · LESSON 1
Free — no login requiredSign in to track progress, save quiz attempts and enrol in the full course.
Sign in to track progress / enrolShadow AI and the Paste Test
No attacker in this lesson. This is the risk created by helpful people trying to do their jobs faster, and it is now among the most common ways confidential material leaves an organisation.
What happened at Samsung
In 2023, within about a month of engineers at Samsung's semiconductor division gaining access to a public chatbot, three separate incidents occurred.
An engineer pasted in proprietary source code to help find a bug. Another pasted a recording transcript of an internal meeting to get a summary. A third pasted chip yield test sequences to help optimise them.
Nobody was malicious. Nobody was even careless by the standards they had been given. Each was doing precisely what the tool is excellent at, using material they worked with every day, to solve a real problem faster.
The company's first response was to ban the tool. Its second was to reverse that and build an internal alternative, which is the arc most organisations eventually travel, usually after discovering that the ban did not work.
Why bans fail
The productivity gain is real. When you prohibit a tool that genuinely makes someone's job easier without providing an alternative, they do not stop. They use it on a personal device, on a personal account, outside any logging, monitoring or policy.
You have not removed the data exposure. You have removed your visibility of it, which is strictly worse: the same material still leaves, and now nobody knows what went where.
This pattern has a name, shadow AI, and the measured figures are striking. Surveys report that roughly three quarters of employees paste data into generative AI tools, and that a large majority of those pastes come from personal accounts outside organisational oversight. The proportion of that material classed as sensitive has risen sharply, and breaches involving unsanctioned AI have moved from a curiosity to a measurable cost line.
Treat those numbers as directional rather than precise, in the spirit of Module 1. The direction is not in doubt.
The paste test
One question, deliberately blunt, applied before you paste anything into any AI tool.
Would I be comfortable if this exact text appeared in public with my name attached to it?
If the answer is no, it does not go into a tool that has not been approved for that class of data.
The test works because it bypasses the reasoning people actually use, which is usually "this is probably fine" or "it is only for a summary". Those judgements are made under time pressure by someone focused on a different problem. A single fixed question is more reliable.
What to remove before pasting
Most work can be done with sanitised text, which is the practical middle path between reckless pasting and refusing to use the tools.
- Names and contact details. Replace with placeholders. A model does not need a real name to improve your phrasing.
- Credentials of every kind. API keys, passwords, tokens, connection strings. If one goes in, rotate it rather than hoping. Treat it as disclosed.
- Customer and patient data. Usually a legal question rather than a judgement call, and in several jurisdictions the consequences attach to individuals as well as organisations.
- Unreleased commercial material. Financials, roadmaps, contracts, pricing, anything under an agreement with another party. Note that summarising a client contract may itself breach that contract.
Two habits complete the picture.
Check whether your input trains the model. Consumer and business tiers of the same product frequently differ on this, and the setting is usually available. Find it once for the tools you use daily, rather than assuming either way.
Verify anything factual before forwarding it. This is LLM09 arriving in your own workflow. Fluent and confident is not the same as correct, and the specific danger is that your colleagues will trust it because it now carries your name. Passing on an unverified claim converts a model's error into your error.
Since prohibition fails and unrestricted use is unacceptable, what should an organisation actually do? A few principles hold up in practice.
Provide something before restricting anything. People route around prohibition when it costs them real productivity. An approved tool, even an imperfect one, removes most of the incentive. Provision first, restriction second, and the order genuinely matters.
Classify by data, not by tool. A blanket rule about a named product ages badly and misses the actual question. What matters is which class of data may go where. Something like: public and internal general material into the approved tool, customer data only into the contracted environment, regulated data nowhere without explicit approval. Staff can apply that to a tool that did not exist when the policy was written.
Make the approved path the easy path. If the sanctioned tool requires three approvals and a training module while the unsanctioned one is a browser tab, you have chosen the outcome. Friction determines behaviour far more than policy does.
Ask rather than police. People conceal what they will be punished for. A team that can say "I have been using this for that" without consequence gives you a real picture of what tools are needed and where the exposure is. A team that cannot gives you a clean policy document and no information.
Write down what happens when someone pastes the wrong thing. They should know exactly who to tell, and know that telling promptly is the expected behaviour rather than a confession. This is the same principle as the incident reporting culture in the third lesson of this module, and for the same reason.
The organisations that handle this well are not the ones with the strictest policies. They are the ones where the approved route is genuinely easier than the unapproved one, and where telling someone about a mistake is unremarkable.
You need to summarise a forty page client contract quickly. Your organisation has not yet approved any AI tool. What is the most reasonable course of action?
Shadow AI
Click to flipUse of unsanctioned AI tools, typically on personal accounts outside organisational oversight. The predictable result of prohibition without provision.
Click to flip backThe most common route for confidential data leaving an organisation now involves no attacker, just capable people using a tool that genuinely helps. Bans fail because the productivity gain is real, so usage moves to personal devices where the exposure is identical and the visibility is gone. Apply the paste test before entering anything anywhere, sanitise by removing names, credentials, customer data and commercial detail, and treat any credential you paste as disclosed. Verify factual output before forwarding it, because your name converts the model's error into your error.