Analysts at GK Solar have found that nearly 40% of employee interactions with public AI services contain confidential corporate information. The conclusion is based on analysis of 12,000 interactions captured during pilots of the Solar Dozor DLP system across 150 large organizations in the financial, industrial, retail, telecom, IT and public sectors during the first half of 2026.
Researchers examined text prompts, copied fragments, uploaded files and attempts to send data to external AI services. Among the queries that included sensitive information, 41% contained source code and system configurations, 30% included personal, financial and other sensitive data, 18% involved intellectual property objects, and the remaining 11% consisted of passwords, tokens and API keys.
Development teams were responsible for 43% of these events. Engineers sent code, error logs and technical descriptions to AI tools for debugging, refactoring and test generation, inadvertently exposing details of internal architecture and systems. Commercial divisions contributed another 26% of risky prompts, which often contained negotiation histories, deal terms, customer databases, contracts and CRM materials.
Analysts, marketers, HR and finance specialists accounted for 23% of incidents, while other departments made up the remaining 8%. A parallel survey conducted by UCSB and Solar showed that 42.4% of 102 respondent companies suspected leaks through AI services and 8.1% had already recorded confirmed incidents. At the same time, one-third of organizations still do not apply any specialized protection measures for AI and ML systems.
Solar considers a complete ban on public neural networks unrealistic. Instead, the company advises organizations to approve permitted services, segment access rights and monitor the content of requests to prevent corporate AI assistants from becoming overly talkative external employees.
