Why? It’s a valid concern in my opinion. You’re feeding OpenAI your intellectual property and just hoping they don’t do anything with it. I have the same concerns with Microsoft’s TypeScript playground
It is a valid concern if you send an entire list of confidential data and ask it to transform that list. However if you ask ChatGPT some questions about coding in general it's no different than searching online.
This comes down to whether you trust your whole organization to act be educated about these issues and be good at judging what's ok.
At the size of Samsung that's just an impossible move, and it's easier to blanket ban a problematic service and have employee request exceptions justifying their use case.
BTW I've been in companies that blanket ban posting stuff online, and got posts security reviewed when asking help on vendor community forums. That's totally a thing.
Yes, 20 lines of transforming jsons from one form to another are exactly what OpenAI employees are looking for in all the data they're gathering. How will my company survive after they get their hands on this?
Good opsec/appsec requires doing things that seem unnecessary. And it depends on the context. Passing a private key or raw text customer password to any type of online tool is never a good idea.