Role-Immersion · Technology (Enterprise) · Near-miss
An employee pasted a confidential deal memo into a public AI tool. Weeks later fragments surfaced in someone else's output. The data is inside a model the company can't recall.
The situation
You are a director of a company in the middle of a confidential transaction. An employee, trying to move faster, pasted a sensitive deal memo into a public AI assistant to summarize it. The terms of service allowed the provider to retain and train on the input.
Weeks later, fragments resembling the memo appear in another user's generated output. The information is now embedded in a model outside the company's control and cannot be deleted or recalled. The transaction counterparties and possibly the market are exposed.
It was a near-miss in intent but a real leak in fact. You must address containment, disclosure, securities-law and confidentiality obligations, and the policy vacuum that let an employee feed secrets to an external model with no guardrail.
“The memo is inside a model we don't own and can't erase. It was a mistake, not malice, but the data is gone. What now?”
Your role · Director, Risk Committee
The decision on the table
The full case, scenario architecture, board materials, and facilitation notes, is shared with boards and partners on request.