What shouldn't you share with ChatGPT?

Why Every Chat Is Potentially Public

Your ChatGPT history isn't a private diary — it's a training dataset waiting to happen. On consumer plans (Free, Go, Plus, and Pro), OpenAI uses your conversations to improve its models by default, and chats are stored indefinitely until you delete them.

Even then, deletion is slower and messier than most users assume. Removed chats can take up to 30 days to be permanently purged, and content already de-identified for training doesn't come back out. Uploaded files can linger in your Library even after the chat that contained them is gone, according to security analysis of OpenAI's data practices.

There's a subtler trap, too: opting out of training doesn't fully protect you. A single thumbs-up or thumbs-down rating on a response can re-enroll the entire conversation into training data — a mechanic confirmed by OpenAI's own documentation and multiple independent security sources.

The stakes aren't hypothetical. Consider what's already happening:

• 39.7% of all AI interactions involve sensitive data, with employees feeding sensitive information into AI tools roughly once every three days, per Cyberhaven research.
• Over 100,000 stolen ChatGPT credentials were found on the dark web by Group-IB in 2024, mostly lifted from malware-compromised devices.
• Samsung employees leaked confidential source code into ChatGPT, turning a convenience feature into a corporate exposure event.

Samsung's incident is the cautionary tale for anyone who assumes "it's just a chatbot." Source code pasted into a prompt became data outside the company's control — and once it's in, pulling it out is effectively impossible.

This is why ESET's heuristic has become the gold standard for chatbot privacy: if you wouldn't email it to a stranger, don't type it into a chatbot. OpenAI itself echoes the sentiment, asking users not to enter sensitive information they wouldn't want reviewed or used. Tom's Guide, after comparing the privacy postures of ChatGPT, Gemini, Claude, and Perplexity, ranked ChatGPT last — precisely because of this default training behavior.

The same logic extends to what you connect to your AI, not just what you type. If you're building agent workflows on top of ChatGPT, the skills and tools you attach determine what data flows where — which is why vetting matters. SkillzBench is building a free directory of agent skills where every skill is security-scanned and benchmarked, plus a free MCP tool that connects your agent only to the skills you explicitly choose, so nothing sees more than it should.

Treat every prompt as potentially visible to the public. That single mindset shift prevents most of the damage before it starts.

The Red List: Six Data Types That Never Belong in a Prompt

Most people already know, vaguely, that they shouldn't paste secrets into ChatGPT. What they don't know is that 39.7% of all AI interactions involve sensitive data — employees are typing it in roughly once every three days, according to Cyberhaven's telemetry research.

OpenAI's own consumer data page says it plainly: "Please do not enter sensitive information that you would not want reviewed or used." Here is the concrete red list that follows from that warning.

Personal identifiers — Social Security numbers, passport numbers, home addresses. On consumer plans, chats are used for training by default, and content already absorbed into training doesn't come back out when you delete the chat.

Financial data — card numbers, bank details, tax IDs. ESET's heuristic applies: "If you would not email it to a stranger, do not type it into a chatbot."

Secrets — passwords, API keys, MFA tokens. These top every vendor's list, and the stakes are real: security researchers found over 100,000 stolen ChatGPT credentials on the dark web in 2024.

Company data — source code, client lists, internal documents, unreleased financials. Samsung's source-code leak remains the cautionary tale.

Health data without a BAA — HIPAA-covered information has no place in a consumer account, and no consumer plan offers a Business Associate Agreement.

Contract-restricted client data — anything a client contract bars from sharing with sub-processors.

The uncomfortable context for all six: deletion is weaker than it looks. Per OpenAI's own documentation and legal records, a May 2025 preservation order in the NYT litigation forced OpenAI to retain logs of chats users had asked to delete — and to produce 20 million de-identified consumer chat logs. Deleted content can also linger up to 30 days, and a single thumbs-up can reverse your training opt-out.

For teams extending ChatGPT into agent workflows, the same discipline applies to what your agents can see. SkillzBench is building a free directory where every agent skill is security-scanned and version-pinned, plus a free MCP tool that connects agents only to the skills you explicitly choose — because a red list only works if the pipeline behind it is equally disciplined.

Your Privacy Controls — and Their Limits

Here's the uncomfortable truth: even if you find every privacy setting ChatGPT offers and toggle them all correctly, your data still isn't fully protected. OpenAI's own documentation makes clear that opting out of training is a partial fix, not a guarantee — and some settings quietly undo themselves.

Start with the main switch. In Settings → Data Controls, disable "Improve the model for everyone." On consumer plans (Free, Go, Plus, and Pro), conversations are used for model training by default, and this setting is the only way to opt out. Tom's Guide ranked ChatGPT last among major chatbots for privacy precisely because of this default, noting it also stores chat history indefinitely until you manually delete it.

But here's the catch most users miss: submitting a thumbs-up or thumbs-down rating can put the entire conversation back into training data, even after you've opted out. OpenAI's help documentation confirms this, and it's easy to trigger accidentally — you rate a response as helpful, and your "private" chat becomes training material.

Temporary Chats offer another layer of protection. These conversations aren't used for training, which makes them the better choice for anything sensitive. However, they're retained for up to 30 days for safety purposes, and — critically — saving a temporary chat to your history removes its protections entirely. The moment you click save, it's treated like any other conversation.

Deletion has limits too. Deleted chats can take up to 30 days to be permanently purged, content already used in de-identified training doesn't come back out, and uploaded files can remain in your Library even after the chat that contained them is gone. Legal orders can also override deletion — a 2025 court preservation order required OpenAI to keep chats users had asked to delete.

Two more honest caveats:

• Paying for ChatGPT Plus doesn't improve data protection. Plus handles your data the same way Free does.
• The real upgrade is a plan change, not a payment: ChatGPT Business, Enterprise, and Edu workspaces don't use inputs or outputs for training by default, per OpenAI's documentation.
• If you're using ChatGPT for work through a personal account, none of those business protections apply — and 67% of corporate-device AI use happens through non-corporate accounts.

The takeaway: settings reduce exposure but don't eliminate it. The same caution should extend to how you extend ChatGPT with tools and agent skills — only connect skills you've vetted. SkillzBench is building a free directory where every agent skill is security-scanned and benchmarked, plus a free MCP connector so your agent only sees the skills you explicitly choose. Until then, apply the simplest test: if you wouldn't email it to a stranger, don't type it into a chatbot.

For Work: Fix Shadow AI Instead of Blocking It

Your employees are already pasting company data into ChatGPT — the only question is whether it happens inside or outside your security controls. The numbers behind "shadow AI" make the stakes concrete: 67% of users reaching AI services from corporate devices do so via personal accounts, and per IBM's findings, 20% of global organizations suffered a data breach in the past year from shadow-AI incidents.

Why blocking backfires

Cyberhaven's research on sensitive data flowing into AI tools is blunt: "Broad attempts to block AI usage rarely reduce risk. Instead, they push usage outside formal controls." Employees don't stop using AI when you ban it — they use it on personal accounts, personal devices, and phones, where you have zero visibility.

The result is the worst of both worlds: the work still happens, but 39.7% of AI interactions involving sensitive data now happen somewhere you can't monitor, on consumer plans that train on your conversations by default.

What actually works

The fix is a sanctioned alternative that's better than the workaround — a Business or Enterprise workspace where OpenAI doesn't train on inputs or outputs by default — plus training that reflects how people actually work:

• Treat every prompt as an external data egress channel — the same class of risk as email or file uploads, per enterprise security guidance.
• Prohibit production secrets, payment-card data, and special-category personal data outright, with documented exceptions only.
• Train staff using realistic examples from their actual workflow, not generic "don't paste data" rules that get ignored by Friday.
• Treat model outputs as untrusted input — citations can be "broken, unrelated, or invented," so verify before output affects money, access rights, or regulated decisions.

The same logic applies to AI agents. With roughly 23% of organizations adopting agent-building platforms, agents amplify data-exposure risk structurally through persistent memory and file-system access — and the skills and tools you bolt onto them matter. SkillzBench is building a free, independent directory of security-scanned agent skills plus a free MCP connector that lets an agent see only the skills you explicitly choose, so your automation never gets more access than the task requires.

Shadow AI isn't a policy failure you can firewall away — it's a demand signal. Give people a sanctioned path that's faster than the workaround, train them on their real workflows, and verify outputs as untrusted. That's how you keep sensitive data out of the wrong chat window.

Extending AI Safely: Agents, Skills, and Least Privilege

ChatGPT's red list gets harder to follow the moment you stop typing and start delegating. AI agents don't just read your prompts — they hold persistent memory, touch your file system, and sync data to outside services, all outside normal security oversight. The stranger-email test suddenly applies to far more than what you type.

The scale of this shift is already visible. Cyberhaven's research shows roughly 23% of organizations have adopted agent-building platforms, and 49.5% of developers now use coding assistants — tools that routinely read repositories, config files, and credentials. An agent with file access doesn't ask permission each time; it reads whatever its connected skills and tools can reach.

Skills add a second, underappreciated risk. Published research found that roughly 26% of published agent skills carry at least one vulnerability — instruction packages that look helpful but can leak data, execute unintended actions, or pull in unvetted dependencies. Installing one is closer to installing a browser extension than copying a snippet, yet most people treat the two the same way.

The security principle that fits here is least privilege: an agent should only see the skills, tools, and data it explicitly needs. That means vetting skills before connecting them, not after. SkillzBench is building a free directory designed for exactly this — every skill is security-scanned, license-checked, and benchmarked in a sandbox before it earns a listing, and its free MCP tool connects your agent only to the skills you actively toggle on. Your agent never sees more than you chose to give it.

Until tooling like that is second nature, a few habits close most of the gap:

• Inventory what your agent can reach — memory, files, synced apps — and remove anything unrelated to its job.
• Vet third-party skills the way you'd vet a vendor: check licensing, maintenance, and security posture before connecting.
• Keep secrets, source code, and client data out of agent memory, not just out of prompts.
• Route work data through a Business or Enterprise workspace rather than a personal account, since personal accounts sit outside corporate protections.

The stakes are not theoretical. IBM found 20% of global organizations reported a data breach in the past year tied to shadow AI, and blocking AI outright tends to backfire by pushing usage further into the shadows. The sustainable answer is a sanctioned, minimal-permission setup — not prohibition.

Strip away the tooling and the checklists, though, and one rule survives every platform change and every new agent capability. If you would not email it to a stranger, do not give it to an AI — whether you're typing it, syncing it, or letting an agent read it on your behalf.