Cybersecurity expert warns that staff using personal ChatGPT accounts for work could retain confidential company information after leaving their jobs, putting employers at risk of serious data breaches

Employees should be stopped from uploading confidential work information to personal AI accounts amid fears they could take company secrets with them when they leave, a leading cybersecurity expert has warned.

Staff using private ChatGPT accounts and other AI tools for everyday tasks could leave sensitive documents, customer details and financial information accessible through accounts outside their employers’ control.

Andrius Buinovskis, the Vice President of Product Strategy at cybersecurity firm NordLayer, told Juliet Foster on Business Matters, in association with The European, that former employees could retain access to confidential business information long after leaving their jobs.

The warning comes amid growing concern over shadow AI, the use of artificial intelligence applications without employers’ knowledge or approval.

Buinovskis said companies encouraging AI use to improve productivity were struggling to control the growing number of applications employees were bringing into the workplace.

He described the result as an “AI zoo”, with approved and unapproved tools being used across departments including finance, sales, design and software development, often without employers knowing what information was being shared.

Even established AI services could pose a threat when accessed through private accounts, potentially exposing businesses to data breaches, reputational damage and even breaches of the General Data Protection Regulation (GDPR), he said.

“There are organisations that actively promote AI use inside the company, like we do, because we understand that AI is the only way to stay competitive in this very fast-changing world,”  Buinovskis added.

“But the tools a company provides might be very good for IT or engineering, yet not meet the needs of designers. So designers start using their own preferred tools that they find on the internet, often without asking for permission.

“There is no malicious intent. People are simply trying to do their work better and be more productive. But companies cannot see those tools. They don’t know which applications are being used, and if company information is being uploaded, they don’t know where it will end up. That could lead to a compliance breach.

“The main risk is data leakage, especially when we are talking about sensitive or regulated information. This includes using a secure AI tool through a personal account. If you use a personal account, it means that when you leave the company, you still have company data in that account.

“And if company information has been submitted to an unapproved tool without any records, visibility or control, there is no way back.”

Buinovskis also warned about AI agents, which can search documents and access databases with limited human supervision, potentially retrieving confidential information without employees realising.

An employee could, for example, upload a spreadsheet to an AI service without realising that one of its columns contains sensitive personal information.

Traditional firewalls, virtual private networks and access controls may fail to prevent such leaks, as they are designed primarily to restrict unauthorised access rather than stop employees from sharing information they are already permitted to use.

But Buinovskis argued that banning AI tools altogether would be ineffective.

“If you ban one tool tomorrow will be another tool,” he said.

Instead, he urged employers to identify which applications staff use, approve new tools more quickly and introduce safeguards that detect confidential information before it leaves company systems.

These could warn employees, remove sensitive details automatically or block risky uploads. New applications should also be tested with non-sensitive data before wider use, he said.

Buinovskis also cautioned that increased monitoring could damage workplace relationships if employees felt they were being spied on.

“The trust is a key player here,” he said.

Businesses should explain what they monitor, involve staff in security decisions and provide training, while recognising that education alone cannot prevent every mistake.

He expects increasingly automated security systems to help businesses of all sizes detect threats and protect sensitive data as AI becomes more widely used.

Despite the risks, Buinovskis said employers should not be afraid to embrace the technology, provided they have safeguards in place to protect confidential information.

“If you are not using AI, you can really lose your competitive edge,” he added.

Watch the full interview with Andrius Buinovskis, Vice President of Product Strategy at NordLayer on The European’s YouTube channel.

VIEW MORE: North Korean agents are infiltrating Western businesses by posing as employees, security chief warns. State sponsored hackers from North Korea and other hostile states are using fake identities, manipulated video interviews and stolen passwords to gain access to Western businesses. And thanks to AI, their methods are becoming increasingly sophisticated and difficult to detect, one of the UK’s leading cyber security chiefs has told The European.

Do you have news to share or expertise to contribute? The European welcomes insights from business leaders and sector specialists. Get in touch with our editorial team to find out more.

_{Main image: Andrius Buinovskis, Vice President of Product Strategy at cybersecurity firm NordLayer, warns that employees using personal AI accounts for work could take confidential company information with them when they leave. Speaking to Juliet Foster on Business Matters, in association with The European and first broadcast on Bloomberg TV, he explains the growing security risks posed by unapproved AI tools and how businesses can protect sensitive data without restricting staff productivity. Credit: The European / NordLayer}