Generative AI tools have created a new and largely unaddressed trade-secret exfiltration channel. An employee can paste proprietary source code, strategic plans, customer data, or financial models into ChatGPT or Copilot under the guise of "getting help with a task" — and that data leaves the company's control in a way that traditional DLP tools rarely catch.
For forensic investigations, the artifact landscape is still developing but increasingly tractable. Enterprise deployments of ChatGPT, Copilot, and Claude generate audit logs that capture prompt content and response metadata. Browser history captures the chat-window URLs. Endpoint clipboard logs sometimes preserve the source material that was pasted. Network logs reveal the upload traffic.
For consumer-tier accounts — where most insider exfiltration actually happens — the artifact picture is harder. ChatGPT's free and Plus tiers don't expose audit logs to enterprises. But browser-side and device-side artifacts often establish that AI tools were used, when, and from which company devices.
Three practical points for counsel:
- Departed-employee investigations now routinely need to include AI-tool usage in scope.
- Enterprise AI deployments should have audit logging enabled and retention policies in place.
- The same forensic discipline that addresses USB exfiltration addresses AI exfiltration — the channel changes; the methodology does not.
We are actively investigating AI-channel exfiltration matters.