Use Of AI Provider That Trains On Your Data
Updated: August 11, 2026
Description
An employee used an AI provider whose terms of service allow user data to be used for model training by default.
Any prompts, files or conversation history submitted to these services may be incorporated into future model training runs. Confidential business information, source code or personal data shared with the service could later be reproduced in responses to other users of the model.
Example Attack
An employee pastes proprietary source code into a consumer AI chatbot to debug it. The provider's terms of service permit training on user submissions, and fragments of the code are later reproduced verbatim by the model when other users ask similar questions, leaking the organisation's intellectual property.
Remediation
Review which employees and devices are using these AI providers and assess what data has been shared. Where the provider offers it, opt out of data training or move to an enterprise tier with contractual no-training guarantees. Configure AI workforce policies to block or log access to providers that train on user data by default, and direct employees towards approved AI services.
Security Frameworks
AI resources must enforce default-deny access, the caller's authorization context must be applied throughout retrieval and inference, and sensitive data must not be permanently stored in models.
AI interactions, safety filtering and policy decisions, and inference telemetry must be logged to a structured, interoperable schema to support audit and incident response.