Gen-AI at Work

Gen-AI at Work: Why Banning ChatGPT Won’t Save Your Data

The Hacker News article explains why simply blocking public generative-AI tools is a poor defence against data loss. Zscaler’s ThreatLabz team saw AI/ML traffic jump 36-fold in 2024 and counted more than 800 different AI apps inside enterprises. When companies ban ChatGPT-style services, employees often bypass controls—emailing files to personal accounts, using smartphones or screenshots—creating an unmonitored risk called “Shadow AI.” The piece argues for a visibility-first, zero-trust approach: discover which AI tools are in use, apply granular policies (e.g., browser-isolation or redirection to an approved in-house model) and layer data-loss-prevention (DLP) controls. Zscaler says its cloud blocked over four million attempted AI data-leak events involving financial, personal and source-code information. The goal is to enable safe AI adoption rather than impose blanket bans.

When ChatGPT burst onto the scene, many IT teams did the obvious thing—block it. Yet Zscaler’s latest figures show that shutting the door hardly slows the tide. In 2024 its ThreatLabz researchers logged 36 times more AI traffic than the previous year, spotting more than 800 separate AI apps on corporate networks.

Shadow AI: the blind spot
Staff simply route around bans: they forward documents to personal email, snap screenshots with a phone, or paste company code into a home PC. These work-arounds create Shadow AI—usage you can’t see, log or control.

Lessons from the SaaS revolution
A decade ago firms fought unsanctioned cloud-storage by offering a secure alternative rather than wielding the big red “block” button. The same thinking applies to AI, but the stakes are higher: leak your source code into a public model and you can’t claw it back.

Visibility first, policy next
Zscaler argues for a stepped approach:
1. Discover which AI tools are in play—who uses them and how often.
2. Apply context-aware policies: allow, warn, isolate in the browser, or redirect to an approved, on-prem model.
3. Enforce DLP: their cloud service blocked 4 million attempted leaks of financial data, PII and source code headed for public AI apps.
Empower, don’t prohibit
With modern zero-trust controls you can let employees enjoy the productivity boost of Gen-AI without handing your crown-jewels to someone else’s language model.