Editorial technology illustration for "What You Should Never Upload to an AI Chatbot"

What You Should Never Upload to an AI Chatbot

Technology advice gets complicated fast when every answer starts with a product, a warning, or fifteen settings you do not understand. This guide takes the practical route: identify the real risk or bottleneck, make the safest useful change, and leave yourself a way back.

The five-question pause

Before uploading, ask: Do I own this data? Does it identify a person? Would exposure cause harm? Does a contract or employer policy restrict it? Can I get the same result with names, numbers, and secrets removed? One uncomfortable answer means stop and redesign the prompt.

Credentials and security secrets

Never paste passwords, recovery codes, private keys, API keys, session cookies, vulnerability details for exposed systems, or complete security configurations into a general chatbot. If a secret was pasted accidentally, treat it as exposed and rotate it.

Personal and regulated information

Avoid unredacted medical, financial, student, employee, customer, legal, and identity documents. A name removed from the top is not enough if addresses, account numbers, dates, or narrative details can re-identify someone.

Confidential work and client data

Company strategy, incident evidence, contracts, source code, customer lists, and internal messages may be restricted even when the tool feels private. Use only employer-approved systems and configurations. “It helped me work faster” is not a data-handling exception.

Screenshots are documents too

Screenshots often leak browser tabs, email addresses, notifications, filenames, tenant names, QR codes, and tokens. Crop tightly, redact locally, and inspect the final image at full size before uploading.

Use a safer substitute

Replace real names with roles, exact amounts with ranges, production code with a minimal example, and live data with synthetic rows. Share the smallest excerpt needed. For sensitive work, keep the task inside an approved enterprise environment with the right retention and access controls.

Donna’s bottom line

Use the simplest process that solves the real problem, document the important choices, and verify the result. More software is not automatically more security, more speed, or more control. A small repeatable habit usually beats a complicated setup that nobody maintains.

Sources

NIST AI Risk Management Framework

Leave a Reply

This site uses Akismet to reduce spam. Learn how your comment data is processed.