"I Spilled All the Secrets I Can't Tell Anyone Else... Now I'm in Trouble" - The "Catch" of Deleting ChatGPT Chats

Data Remains on Servers and in Backups Even After Deletion from Chat Window
Retained for Up to 7 Years... Virtually Impossible to Erase Completely
"Shadow AI" Without Company Approval... Security Management Concerns

Many people enter company secrets, security documents, personal information, and other sensitive data into generative AI chat windows, then delete their chat histories after the fact. But believing that the data has been completely erased just because the conversation has disappeared from the screen is a dangerously mistaken assumption. Relevant records may still be retained in AI companies' backup systems and server logs. Moreover, information already incorporated into AI algorithm training is virtually impossible to remove because of technical limitations.

AI-generated image, not directly related to this article. ChatGPT

Data Remains on Servers and in Training Systems Even After Chats Are Deleted... Security Incidents Surge

Global market research firm Gartner warned in its recently published report, "Respond Quickly to Shadow AI Data Exposures," that so-called "shadow AI"—the use of personal accounts by company employees for work without security approval—is emerging as a serious security threat.

The core issue is that even when employees use company PCs, connecting through personal AI accounts means that corporate data protection measures do not apply, leaving confidential information vulnerable to collection on external servers.

AI-related data breaches are, in fact, on the rise. According to an IBM report cited by Gartner, covering the period from March 2025 to February 2026, shadow AI was involved in 43% of all data breach incidents, more than double the share from the previous year. The average cost per incident reached $5.39 million (approximately 7.2 billion won), and nearly half of the incidents involved serious breaches of internal information.

Retained for Up to 7 Years in Safety Review Systems... The Limits of "Machine Forgetting"

According to Gartner's analysis of data retention mechanisms, chat histories and server request and response logs are generally retained for about 30 days even after users click the delete button. In particular, data that AI systems classify as inappropriate or dangerous is kept in separate storage for safety reviews for between two and up to seven years. Information collected for AI training may also be retained for up to five years.

The most serious problem lies in the way AI models are trained. Once input data is statistically embedded in the parameters used to retrain an AI model, it is technically very difficult to remove only that information's influence from the training results, even if the original file is deleted. Technology for selectively deleting specific data, known as "machine unlearning," is still at the research stage. Retraining a large AI model from scratch also entails enormous costs, making it an impractical alternative.

Experts advise that as soon as users become aware of a data exposure, they should first disable the AI service's "Data Training" feature and immediately change any exposed passwords or authentication credentials. Rather than assuming that on-screen deletion is sufficient, users need systematic security management that includes checking where the service stores data and how long it retains it, and verifying that the data has actually been deleted.

This content was produced with the assistance of AI translation services.