1. News
  2. AI law & regulation
  3. Work · AI privacy
Work · AI privacy2 min read

Staff can paste work files into personal AI accounts through a web browser

Company tools can spot unapproved AI apps on work Macs, but a personal ChatGPT or Claude tab in a browser is much harder to see or stop.

By the Dashline deskSource: 9to5Mac
Staff can paste work files into personal AI accounts through a web browser
Photo: 9to5Mac

An employee opens Safari or Chrome, logs into a free personal ChatGPT or Claude account, and uploads a company document to ask a question about it. According to Apple IT admin Bradley Chambers, writing in 9to5Mac's Apple @ Work column, most IT teams may never see that happen.

Why apps are easier than browsers

Companies that manage a fleet of Macs can already see which apps are installed. If someone adds an unapproved AI coding tool, IT can detect it, flag it and remove it automatically. A website is different. Nothing is installed, so nothing appears in the app list. How much IT can see depends on its web filtering setup.

Two fixes on the way

The first is from Jamf, a company that makes tools for managing Apple devices. It plans browser AI controls for the fourth quarter of 2026. Admins would be able to spot personal AI account use in Safari, Chrome, Firefox, Edge and other browsers, and block actions as they happen.

The second is an enterprise browser: a work browser that IT controls from the ground up. Island is the best-known example. IT can set which AI sites staff may reach, whether they can paste company data into a prompt, and what they can upload or download. Island recently announced a $400 million round at a $6.4 billion valuation.

The tradeoff

Asking people to switch browsers is a harder sell than pushing out a policy. Chambers notes that Safari is deeply built into the Mac, so replacing it as a daily browser is likely to meet pushback. Chrome faces the same issue. Still, he thinks Island's model could become the default for many large companies.

What to do now

Chambers says the tools are either just arriving or still in development, and written policies have not caught up. Until the tools mature, a clear rule is the main safeguard. A business can state what company files may go into AI websites, and whether personal accounts are allowed at all.

  • Tell staff plainly whether company files may go into AI sites.
  • Say if personal AI accounts are allowed for work.
  • Ask your IT provider what it can see in the browser.
The takeaway

Blocking AI apps is not enough, so set a clear rule on company files in AI websites before the browser tools arrive.

More articles

You should really read these.

Next step

Let’s talk