A001 · PK/AI/Data-Security/AI-Tools/How-Did-This-AI-Tool-Get-My-Data
How Did This AI Tool Get My Data?
· 2 min read · Originally published on LinkedIn ↗
A worried friend called me recently.
"Munaf, how does this AI tool have my data?"
I won't name the tool. It's quite popular. The information involved was important to his organization and had become public.
I asked him, "Do you or your team use this tool?"
"Yes."
I said, "Bhai, if you're giving your own data to a service, we first need to understand what that service does with it."
Then I couldn't resist: "Allah ke bande, values to remove kar dete!"
We laughed. Lekin baat sochnay wali thi.
How many people are doing the same thing every day without realizing the possible consequences?
A junior staff member wants help writing an email. Someone else wants to summarize a report or make sense of a spreadsheet. They copy the information into a free or inexpensive AI tool and get the answer they need.
For them, AI has filled a gap. Kaam asaan ho gaya.
But what else went into that prompt? Customer details? Internal prices? A confidential document?
I'm not saying every AI service trains on everything we submit. Terms, account types and settings differ. But how many people know which service does what? And even if a provider doesn't use the information for training, where is it stored, processed or accessed?
I've been talking to CISOs, banks and other organizations about this. Everyone has a different challenge and a different opinion. Policymakers have their own perspective too.
One answer I often hear is: "Keep the AI on our own premises."
Theek hai. But then come more questions. Which GPU? Which model? How much memory does it need? Can we afford to run it? Will it actually do the work our people need?
Local capacity, cost and access are still challenges, especially for larger models. Does every organization need to solve this on its own?
We have to learn to live with AI. We cannot simply tell people not to use it when it is already helping them do their jobs.
Maybe we start with a few practical steps: give employees an approved tool, explain what they should never upload, and test the right model for the actual work before investing in infrastructure.
But I would like to hear from you. What is working in your organization? What still worries you? And how are you balancing the benefits with the risks?
My time as Co-Chair of Industry Engagement at P@SHA gave me a view of both the vendor side and academia. My work as Chair Cyber at FPCCI gave me insight into the concerns of CISOs, security experts and government policymakers. With those experiences, perhaps I can contribute something useful to this conversation.
And there is another question we should not forget: how does the common person benefit from AI?
That is one reason I started Maahir.io. We teach people how to use AI tools free of cost. The vision goes beyond the tools themselves: helping people learn new skills, build confidence and use technology to create opportunities.
Hum sirf platforms nahi, log bana rahe hain. If you believe in that vision, collaborations are welcome.
AI is already here. The question is: how do we make it work for our people while protecting what matters?
#AI #Pakistan #Cybersecurity #DataPrivacy #AIAdoption #Maahir
Quick answers
Frequently asked questions
How can an AI tool end up with my organisation's data?
Often because staff put it there. Someone wants help writing an email, summarising a report or making sense of a spreadsheet, and copies customer details, internal prices or a confidential document into a free or inexpensive AI tool.
Does every AI service train on what we submit?
Not necessarily. Terms, account types and settings differ. But even if a provider doesn't use the information for training, you still need to know where it is stored, processed or accessed.
Is keeping AI on our own premises the answer?
It raises its own questions: which GPU, which model, how much memory, whether you can afford to run it, and whether it will actually do the work your people need. Local capacity, cost and access are still challenges, especially for larger models.
What practical first steps does the article suggest?
Give employees an approved tool, explain what they should never upload, and test the right model for the actual work before investing in infrastructure.
From LinkedIn
What people are saying
“What's working for us is treating data risk as a governance-at-execution question, Mohammad — clear boundaries on what data can go into public tools, and private inference where it matters. The cartoon nails the anxiety: people love the tools, but they need to know their…”
“Dear Munaf - this is the reality nowadays. No matter how much awareness is given to people, they just want it easy at the end. I learned sometime back that nothing is free in this world - if it is free, then WE become the product. In this case, the product is the data we share.”
“Zabardast! Thank you for this excellent and very timely write-up. Loved your thought-provoking questions and engaging style. As you have rightly advised, before using any tool/solution, we need to recognize and understand the risks and consider the related costs/consequences...”
“Amazing article Mohammad Munaf Majeed bhai. How to live with AI is everyone concern these days. But somehow, generally, we are not dealing with it the way it should be due to lack of governance or absence of right frameworks and awareness.”
“spot on Mohammad Munaf Majeed bhai need of the hour data governance is something I have been talking about especially PII data and laws are needed around it”
Selected comments from the LinkedIn post, shown as excerpts. Dates are approximate.
Read all 17 comments on LinkedIn ↗