Deletion of conversation remains in server/backupUp to 7 years when inappropriate content is judged “New security threat…Need to respond” 사진 확대 Artificial intelligence (AI) generated images. [Chat GPT] An office worker A posted internal data of the company on ChatGPT to handle the work quickly. I deleted the conversation record because I was worried about security issues late. Since the conversation disappeared from the screen, would the company data have been completely erased as well?Not necessarily. This is because information may remain on AI companies’ servers or backup systems even if they disappear from the chat window in front of them.There have been warnings that company secrets or personal information entered into generative artificial intelligence (AI) may remain for years after deleting conversation records. In particular, information used to learn AI models is virtually impossible to delete, emerging as a new security threat for companies.Gartner, a global market research company, pointed out such risks in its recently released ‘Act Quickly to Remediate Shadow AI Data Loss’ report.Shadow AI refers to an AI service used by employees for work without official approval or management from a company. It is typical to use a Generative AI that is not allowed by the company as a personal account. Employees use Generative AI such as ChatGPT from their company’s computer to their personal accounts.The problem is that the information entered into AI is not only stored in the chat window. According to Gartner, the input data can be spread to various places, including conversation records, server request and response logs, safety review systems, temporary storage spaces, backup servers, and AI learning data. The information storage period and deletion method are different for each storage space.The proportion of AI in actual security accidents is also increasing. According to IBM’s 2026 Data Leakage Cost Report (March 2025-February 2026) cited by Gartner, the proportion of security incidents involving shadow AI more than doubled from the previous year to 43%. The average cost of damage in these accidents was $5.39 million (about 7.2 billion won). Nearly half of the data were leaked or infringed.You erase conversation records, but you can’t erase information learned by AI 사진 확대 Data storage area for AI models. [Gartner] Looking at the typical data archiving case presented by Gartner, conversation records can remain for about 30 days after deletion. The request and response records stored in the server may also be stored for about 30 days.There is also information with a longer storage period. Records classified by AI as dangerous or inappropriate can remain in the safety review system for two to seven years. Data collected for use in AI learning can be kept for up to five years.A bigger problem is information that AI has already learned. When an AI model learns certain information, its content is reflected in a statistical form in numerous parameters. Gartner explains that even if the original data is deleted, it is virtually impossible to completely remove the impact of the information from the learning results.Gartner evaluated that ‘machine unlearning (machine forgetting) technology, which removes only specific information learned by AI models, is still in the research stage. He pointed out that re-training models that have already been trained without the information is also difficult to be a realistic alternative because of the enormous cost.It should also be noted that the security policies of enterprise and personal AI services are different. If the same AI is used as a personal account, it may not be able to receive data protection measures applied to corporate services. In other words, corporate security policies are not applied just because they are connected to the company’s computer.Gartner recommended that if the information is leaked, the AI learning utilization function should be blocked and conversation records and stored personal information should be deleted. He advised that since information already used for learning is difficult to delete, the possibility of additional leakage should be checked and exposed authentication information such as passwords should be changed immediately.In particular, he warned that erasing conversation records from the screen does not mean that the information has been completely deleted. It is explained that information may remain in server logs or backups, so it is necessary to check the storage location and storage period, and verify whether it is actually deleted.
Click Here For The Original Source
——————————————————–
