By · Last updated 2026-04-15

返回博客人工智能安全

为何制度规范无法阻止ChatGPT泄露个人信息

77%的企业AI用户会将数据直接复制粘贴到聊天机器人中。上传的文件中近40%包含个人身份信息或支付卡数据。HIPAA安全规则拟议更新。

April 15, 20268 分钟阅读
ChatGPT PII leak preventionChrome extension DLPenterprise AI policytechnical controls browsercopy-paste PII protection

复制粘贴问题

77%的企业AI用户会将数据直接复制粘贴到聊天机器人的查询框中。 这并非边缘行为,而是员工在工作中使用AI工具的默认方式。

操作模式十分简单:员工面临一项任务,打开文档,复制相关文本,粘贴到ChatGPT中,获得有用的回复。

这一工作流程中没有任何环节会过滤个人数据。粘贴操作发生在她自问「这段内容是否包含个人信息?」之前。等到她看完AI回复时,数据早已传输完毕。

Cyberhaven的研究发现,上传到AI工具的文件中近40%包含个人身份信息(PII)或支付卡行业(PCI)数据。 这些上传行为大多并非出于疏忽,员工只是在处理分配给他们的文件,其中的客户数据只是附带的。

为何培训无法规模化

制度培训面临结构性局限——它试图通过定期教育改变习惯性行为。

培训间隔期正是问题所在。大多数企业项目每年开展一次。一名员工在一月份接受过AI数据处理培训,到了十月份便已凭借习惯行事。记忆会衰退,习惯却持续存在。

2025年3月提议的HIPAA安全规则更新正反映了这一点:它要求进行年度加密审计,而不仅仅是年度培训。监管机构期望技术管控措施成为主要保障手段,培训只是补充。

AI工具使培训问题更加复杂。这种行为模式是全新的——员工十年前并没有养成AI数据处理习惯,就像他们对电子邮件所形成的习惯一样。而且数据泄露是不可见的:员工看到的是一个有用的回复,没有错误信息,没有即时的负面反馈。

没有反馈,行为就不会自我纠正。

浏览器扩展如何拦截粘贴操作

Chrome扩展程序在剪贴板层运行,介于复制操作与AI工具输入框之间。

拦截机制如下:员工从工作应用程序中复制文本,切换到ChatGPT标签页并粘贴。扩展程序在内容出现在输入框之前,于粘贴操作的瞬间检测剪贴板内容中的个人信息。

屏幕上会出现一个预览弹窗,精确显示即将发生的变化:

「客户姓名「Maria Schmidt」→「[PERSON_1]」;邮箱「maria.schmidt@company.de」→「[EMAIL_1]」」

员工可以选择使用脱敏版本继续操作,也可以在替换结果不符合任务需求时取消。

这一设计实现了双重目标:首先,操作是透明的——员工能看到工具做了什么,有助于建立信任,避免将隐私管控误解为监控行为;其次,分类决策是显式的,每个脱敏步骤都需要人工确认,不会将决策完全自动化。

实际应用示例

以欧洲某电商公司的客服团队为例。客服人员使用ChatGPT起草回复,会粘贴包含姓名、订单号和地址的客户邮件。

启用扩展程序后,每次粘贴都会触发脱敏检查。客服人员提交脱敏后的提示词,ChatGPT的回复引用脱敏后的占位符,客服人员阅读建议并将其融入实际回复中。

客服质量保持不变,GDPR第5条数据最小化原则得到满足,客户的个人数据从未抵达OpenAI服务器。

制度培训无法实现这一结果,而剪贴板层的技术管控措施可以。

制度作为辅助手段,而非主要管控

制度培训有其价值——它设定期望,构建基础意识。但它无法在实时状态下拦截一次粘贴操作。

HIPAA规则更新指明了合规的走向:可审计的技术管控,而不仅仅是有据可查的培训项目。单纯依赖培训的企业面临一个审计缺口,只有技术层才能填补这一空白。

延伸阅读:

参考资料

准备好保护您的数据了吗?

开始使用 285 种实体类型在 48 种语言中匿名化 PII。

About this page

We update this page when our platform or the law changes.

Read our founder note for how we work.

Each change shows up in the timestamp at the top.

Related reading

We follow these rules

  • GDPR (EU 2016/679).
  • ISO/IEC 27001:2022.
  • NIS2 (EU 2022/2555).
  • HIPAA safe harbor under 45 CFR § 164.514(b)(2).

Our promise

We do not sell your data.

We do not train models on your text.

We store your files in Germany.

You can delete your account at any time.

You own your work.

Where we run

Our servers live in Falkenstein, Germany.

We use Hetzner. They hold ISO 27001 certification.

All data stays in the EU.

Backups run every day.

Need help?

Email support@anonym.legal.

We reply within one business day.

How we test

We run a full check suite on every release.

Each surface gets its own sweep script and report.

Human reviewers spot-check the output each week.

We track recall and precision on a labelled set.

Bad runs block the deploy.

What we never do

  • We never sell your information to third parties.
  • We never train models on what you upload.
  • We never keep your work after you delete it.
  • We never share keys with any outside firm.
  • We never run ads inside the product.

Plans in plain words

We sell credits, not seats.

One credit covers one short job.

Long jobs use a few credits each.

You can top up at any time.

Unused credits roll over each month.

Read the plans page for current rates.

Who built this

A small team of engineers and lawyers built this.

We ship from Europe and work in the open.

Our founder note spells out why we started.

Where to start

How the parts fit

A browser add-on cleans text inside Chrome.

A Word plug-in handles drafts in Office.

A small desktop tool works on whole folders.

An agent protocol link feeds large models safely.

All four share one core engine and one rule set.

Words from our team

We started this work after a lunch about cookies.

One friend kept getting odd ads on her phone.

We asked why a court file leaked through a draft.

We sketched the first build on a napkin that week.

By month three we had a tiny demo for a friend.

She used it on her first case the next day.

Common questions we hear

Can the tool read scanned PDFs? Yes, with OCR.

Does it work on long files? Yes, in small chunks.

Can I roll my own rule set? Yes, save it as a preset.

Does it run offline? The desktop build runs offline.

Do you keep my files? No, the cloud build wipes after each run.

Will it learn from my work? No, we never train on inputs.

A short tour of the workflow

Upload a file or paste a snippet of prose.

Pick the entities you want gone from the draft.

Choose a method: replace, mask, hash, encrypt, or redact.

Press run and watch the side panel show each hit.

Skim the result and tweak any rule that misfired.

Save the cleaned file or send it to a teammate.