Security and Privacy in Using AI Chatbots

What do chatbots do with your information?

Everything you type or upload into an online chatbot is processed on the creator company's servers and usually stored for some time. Depending on your account settings and subscription type, it may:

• Be used to improve and train future models (can be disabled in many services);
• Be reviewed by staff to check for violations;
• Be disclosed to others in the event of a data leak or unauthorized account access.

Never enter this information

• Passwords, SMS verification codes, and API keys
• Bank card numbers, CVV2, and account information
• Images of national IDs, passports, and identity documents
• Detailed medical information along with names and specifics
• Customer data, employee data, or company confidential documents (except in enterprise versions with a specific contract)
• Source code containing passwords and server connection information

If you need help with a sensitive document, first replace names, numbers, and details with generic terms; for example, "Customer A" instead of a real name.

Suggested settings

1. In the service's privacy settings, check the option Use conversations to train models and turn it off if you wish.
2. For sensitive conversations, use modes like Temporary chat which are not saved in the history.
3. Enable Two-factor authentication for your account.
4. Enable extensions and integrations (to email, Drive, etc.) only for trusted services and remove unused permissions.
5. For truly confidential information, run the model on your own computer.

Watch out for smart scams

Artificial intelligence has also made scammers' tools stronger:

• Voice Cloning: With just a few seconds of someone's voice, it can be simulated. If "a family member" calls with a familiar voice asking for urgent money, hang up and call them back on their usual number. Set a family code word for emergencies.
• Deepfake Video and Image: Check controversial images and videos from reliable sources before reposting.
• Flawless Phishing: Fake emails and messages no longer have spelling errors. Instead of the message appearance, check the sender address and links.
• Fake Apps and Bots: Fake versions of "ChatGPT" or "Free AI" are abundant in app stores and Telegram. Only use the official site and app of the creator and do not give your account information to unknown bots.

For businesses

• Write a written policy for employees on using AI tools: which tools are allowed and what data is prohibited.
• For organizational data, use enterprise versions (Enterprise/Team) or APIs with non-use data contracts for training.
• If you are building a chatbot or intelligent agent, take the risk of prompt injection seriously: the model must not access sensitive information or take irreversible actions without human approval.
• Human-review AI outputs before using them in important decisions.

Quick Checklist

• [ ] I never entered passwords, banking info, or identity documents.
• [ ] I checked the model training settings with my data.
• [ ] Two-factor authentication is enabled.
• [ ] I only use the official app and website.
• [ ] I have set a code word with my family for emergency calls.
• [ ] I verify important claims in responses with reliable sources.