Since its launch in November 2022, ChatGPT has revolutionized the way we approach content creation, reporting, and communication. This innovative AI has become a go-to tool for a myriad of business applications, ranging from drafting content marketing to enhancing customer service interactions, conducting research, and creating documentation like presentations.

But is ChatGPT safe for users and their data? In this blog post, we cut through the complexity to clearly address this pressing concern. Our thorough examination covers OpenAI’s security measures, potential data risks, and essential safety tips for using ChatGPT responsibly. Stay informed and protected as we unravel the essentials of ChatGPT’s safety in the following sections.

Key takeaways

• OpenAI has completed a SOC 2 audit and implements strict access controls to secure ChatGPT, but risks like data breaches still loom
• Individual users need to be vigilant about the information they’re feeding Chat-GPT when writing prompts. They should also take care to avoid scams, misuse of AI, and compromise of sensitive data while using ChatGPT and similar technologies
• Similarly, businesses that incorporate AI and ChatGPT into their products need to take special care to determine a rationale for their use
• Adhering to evolving AI security measures, managing data settings, and understanding legal implications are key to maintaining user trust and privacy

High level: What is ChatGPT?

ChatGPT is a by-product of GPT-3, a third-generation pre-trained transformer developed by OpenAI. In basic terms, ChatGPT is powered by a Large Language Model (LLM), which is a statistical tool to predict the probability of the next word in a sentence.

You can ask ChatGPT certain questions in English, and it will respond with a ‘statistically plausible’ answer based on a very large data set. The answers may appear to be well-written and authoritative, but if you dig a little deeper, you may find it will generate incorrect answers by unintentionally stitching wrong pieces of information together.

The AI achieves its impressive performance by using machine learning algorithms to predict the next word in a sequence, given all the previous words within the text. This allows it to generate coherent and contextually relevant content. ChatGPT can be fine-tuned for specific tasks, industries, or applications, making it an incredibly versatile tool for both personal and professional use.

Its conversational abilities make ChatGPT an excellent fit for chatbots, virtual assistants, and customer service applications, where it can provide instant responses that are often indistinguishable from those a human would give. As such, ChatGPT has quickly become an indispensable asset in various sectors, revolutionizing how we interact with technology.

Evaluating ChatGPT’s security profile

OpenAI, the ChatGPT creator, adheres to stringent security compliance, demonstrated by its SOC 2 audit. This achievement elevates the security of both the ChatGPT Enterprise and its API platform, marking the initial stride in a series of comprehensive safety measures implemented by OpenAI.

To protect customers, intellectual property, and vital data, OpenAI enforces rigorous access control measures and encompasses thorough security protocols such as penetration testing.

The complete list of compliance listed on OpenAI’s website (as of May 2024) includes:

• CCPA (learn more about CCPA compliance)
• GDPR  (learn more about GDPR compliance)
• SOC 2 (learn more about SOC 2 compliance)
• SOC 3
• CSA STAR

The same site offers access (upon request) to various documentation, including pentest reports, their SOC 2 report, SIG core, and more.

A brief history of Chat-GPT information breaches/leaks

The journey of ChatGPT hasn’t been without its share of data security incidents, which serve as stark reminders of the vulnerabilities inherent in even the most sophisticated AI platforms. Here’s a concise history of some notable breaches:

• March 2023 Data Leak: A data leak allowed some users to see content from another active user’s chat history. Perhaps even more concerning, the Chat-GPT shared that the same bug may have caused the unintentional visibility of payment-related information of 1.2% of the ChatGPT Plus (the paid version of Chat-GPT) subscribers who were active during a specific period. Open AI took Chat-GPT offline to patch this bug. You can read more about the incident on OpenAI’s website here.
• Credentials Breach (June 2022 – May 2023): Over 100,000 ChatGPT account credentials were found for sale on dark web marketplaces. This breach was attributed to various info-stealers like Raccoon, Vidar, and RedLine, which collected the credentials over nearly a year. The breach underscored the importance of strong password practices and the use of two-factor authentication to enhance account security.

Each information breach has been a learning opportunity for OpenAI, enabling the organization to refine its security strategies. The implementation of advanced encryption, regular security audits, and the introduction of the Bug Bounty program are direct results of past experiences. These proactive steps are part of OpenAI’s commitment to user safety and the ongoing effort to secure the integrity of ChatGPT’s data.

Is the ChatGPT app safe? Five key considerations

As the adoption of AI-powered tools like Chat-GPT continues to rise, it’s crucial to scrutinize their safety and integrity. Below, we delve into five key considerations.

1. Potential spread of misinformation/disinformation or copyrighted material

While the platform may have achieved the above-mentioned compliance, this should not create false reassurance of the validity or accuracy of the information it generates. Where does GPT-3 come up with the information it presents? To the best of our knowledge, this information was obtained by at least five (5) sources:

• Common crawl: By crawling websites, deduping information, and utilizing a ranking process to determine higher quality sites
• Web text: By extracting texts from websites and again, deduping the information along with utilizing criteria to determine ‘quality’
• Books 1: Collection of unpublished novels
• Books 2: Smaller input of Books1, which is undetermined
• Wikipedia: English version

ChatGPT uses mathematics based on a large quantity of content to determine the next words in a sentence, but may not be accurate or understand the ‘context’ of the information being presented. ChatGPT may be good at answering ‘general’ questions but may not be trustworthy when relying on it for precise answers.  Because of the perceived ‘productivity boost’ of using AI, ChatGPT may abet the spread of misinformation more quickly than other tools.

Moreover, as AI systems generate content based on extensive training data, they may inadvertently infringe on copyright if the AI has been trained on protected works and produces similar output.

But think of it this way: Just as you can Google a question and get a variety of answers – some credible and some falling more into the category of misinformation and even disinformation – so too can you ask ChatGPT a question and get a mixed bag of answers. Unlike Google; however, you may not know where the source of the information is coming from with ChatGPT.

Any information consumed online needs to be carefully evaluated for everything, including accuracy, recency, plagiarism, misinformation, and disinformation.

2. Data collection uses

One major concern regarding the use of ChatGPT is when it’s used to share personal information (or other sensitive/proprietary information).

Any information shared with ChatGPT (or OpenAI) can be used to improve their services. OpenAI also warns to use their service at ‘your own risk’ since it is still in ‘beta.’ To be fair, OpenAI allows you not to have your content ‘shared,’ but it could diminish functionality or limit the ability to address certain use cases.  (See OpenAI’s Terms of Use for further information.)

Organizations need to exercise caution when sharing personal or sensitive information. For instance, ChatGPT may be able to review your code, but your code should be considered proprietary information.

When it comes to processing personal data, you must provide privacy notices and obtain consent for processing such data, which includes, in most cases, processing by subprocessors like OpenAI. OpenAI may execute a Data Processing Addendum, but realize once the information is ‘shared’ with the huge data lake, it could be hard to secure (or ensure it isn’t shared any further for other purposes).

3. Reputational concerns

If your organization depends on being an ‘expert’ on certain topics, using ChatGPT may pose reputational hazards. Although ChatGPT may produce content at scale, it may end up taking you longer to ‘vet’ the content.

Many niche publications have taken steps to protect their reputation as subject matter experts by banning the use of AI in their content creation. For example, Food & Wine magazine states, “It is against our guidelines to publish automatically generated content using AI (artificial intelligence) writing tools such as ChatGPT.”

Similarly, many larger B2B and B2C organizations have similar policies regarding their content marketing, including thought leadership and social media. However, using ChatGPT as a research or editing tool rather than an information-generating tool may still offer efficiencies in the content creation process.

While reputation is a top concern, accurately describing your product or service is also essential for protecting your organization against unfair or deceptive trade practices regulated by the Federal Trade Commission. Utilizing ChatGPT to embellish marketing content without human review could lead to violations.

4. Could Chat-GPT be used as a hacking tool?

The advanced capabilities of ChatGPT raise questions about its potential misuse in cyberattacks. It’s important to evaluate whether ChatGPT could assist in hacking endeavors and what measures are in place to prevent such scenarios. The sophistication of ChatGPT’s language processing may lend itself to crafting phishing emails or generating code to exploit vulnerabilities.

However, OpenAI has implemented safeguards to detect and prevent the misuse of its technology for malicious purposes. Users must be aware of these risks and the importance of adhering to best practices for cybersecurity when interacting with artificial intelligence platforms like ChatGPT.

5. A proliferation of ChatGPT scams

As the popularity of ChatGPT soars, it’s important to recognize that not all associated risks fall within OpenAI’s control. Particularly concerning is the uptick in scams that exploit the ChatGPT name, leveraging the AI’s prominence to deceive users with fake ChatGPT apps.

While OpenAI is committed to user safety, individuals—especially those less familiar with AI technology—must also exercise vigilance.

Scammers may craft counterfeit ChatGPT websites, impersonate the service in communications, or promote fraudulent ChatGPT-related offers. These deceptive tactics aim to harvest personal and financial information. It is crucial for users to stay informed and cautious, recognizing that the onus is on them as much as on OpenAI to navigate these external threats skillfully as ChatGPT becomes increasingly woven into the fabric of everyday technology use.