Conclusion

Let’s get straight to the point. The “scope of what AI can see” has suddenly expanded this week.

ChatGPT can now read the contents of browser tabs. Amazon has launched a device that continuously records conversations for around 10,000 yen. Researchers have begun to uncover how much location data from iOS is being sent to Apple.

What these three news items have in common is that “the range of data handed to AI is expanding without users’ awareness.”

For large corporations, the information security department creates policies. But what about companies with 5 or 10 employees? The answer is simple: decide on a one-page rule by the end of this week. That alone can mitigate 80% of the risks. Let’s explain step by step.

—

ChatGPT’s Chrome Extension—”What is Being Read Behind the Convenience”

OpenAI has updated the ChatGPT Chrome extension, allowing it to read the contents of the browser tabs that users have open.

This is indeed convenient. When you have multiple tabs open for comparison, you can ask, “Summarize the contents of these three pages,” and get a response in seconds. The time spent on research or competitive analysis can feel like it has been reduced to a third.

However, take a moment to think: What do you currently have open in your browser?

• A cloud invoice with estimates from a business partner
• A CRM screen displaying customer lists
• A net banking balance inquiry page
• Logs of internal chat conversations

If these tabs are open while the ChatGPT extension is enabled, theoretically, their contents could be sent to OpenAI’s servers. OpenAI explains that they do not use this data for model training, but the fact that data passes through their servers is a risk.

For small businesses, a customer list of 50 is a lifeline. One entry from a large corporation’s customer list of 50,000 is not comparable to one entry from your company’s 50. The damage from a leak would be far more catastrophic for a small business.

The solution is simple. When using the ChatGPT extension, close all business-related tabs. Alternatively, separate your business browser from your AI browser. Use Chrome and Edge, or create two profiles in Chrome. The cost is zero, and it takes about five minutes.

—

Amazon “Bee”—The Shock of an AI Device That Records Conversations for $74.99

Amazon’s newly announced personal AI device, “Bee,” is available for purchase starting at $74.99 (approximately 11,000 yen). It offers conversation summarization, automatic task list creation, and integration with Alexa. In other words, you can obtain a “permanently on personal assistant” for just over 10,000 yen.

Consider what this pricing means. Traditionally, outsourcing meeting minutes would cost between 5,000 to 10,000 yen per session. If there are 10 meetings a month, that amounts to 50,000 to 100,000 yen. Over a year, that totals 600,000 to 1,200,000 yen. With Bee, the initial cost is just 11,000 yen, plus running costs. We are looking at a world where costs are reduced to less than one-hundredth.

If you are a small business owner, these numbers are enticing. In fact, depending on how it is used, it could lead to a dramatic increase in productivity.

But the issue is, what is Bee listening to, what is it recording, and where is that data being sent?

Amazon has a history of reporting that “user voice data was heard by employees” via Alexa. If Bee records meeting content, it could include names of business partners, amounts, and negotiation strategies. Storing this information on external servers means that your negotiation cards are placed in Amazon’s cloud.

Using it because “it’s convenient” is valid. However, using it without deciding “what to let it hear and what not to” is akin to conducting negotiations with the meeting room door wide open.

—

iOS Location Data—Data Being Sent Without User Consent

Recent research has begun to reveal the details of the data iOS location services are sending to Apple. There are indications that even without explicit user permission, information about Wi-Fi access points and Bluetooth device detection data is being transmitted.

This may seem like a personal issue, but it is not unrelated to small businesses.

If a sales representative visits clients using a company smartphone, their movement history is accumulated on Apple’s servers. Which companies are visited in what order, and where sales resources are concentrated—these are significant sales strategy data.

For large corporations, sales offices are spread across the country, and data is dispersed. However, in a company with 10 employees and 2 salespeople, tracking the movements of those 2 can reveal nearly the entire company’s strategy. Small businesses have a higher density of valuable location data.

—

Categorizing “Data That Can Be Handed to AI” into Four Levels

If you’ve read this far and thought, “I won’t use AI because it’s scary,” that’s a mistake. The risk of not using AI is now far greater. If competitors are cutting costs in half with AI while you continue manual work, you will undoubtedly lose.

The correct approach is to “use it, but draw the line on what data to hand over.”

Let’s organize this into four levels. You can directly use this as your internal rules.

Level 1: Absolutely Do Not Hand Over to AI (Red Zone)

• Customer personal information (name, address, phone number, email address)
• Contracts and NDAs with business partners
• Bank account and credit card information
• Employee My Number and salary information
• Login IDs and passwords

→ Inputting any of these into AI is a no-go. If tabs containing these are open, turn off the extension or close the tabs.

Level 2: Okay for Internal AI, Do Not Hand Over to External AI (Yellow Zone)

• Sales data, cost ratios, profit margins
• Price lists, supplier lists
• Unpublished new product or service proposals
• Internal meeting minutes and strategy meeting content

→ You can utilize local AIs (like offline LLMs) or services that can be set to “not use for learning” via API. For ChatGPT, use the API version with the opt-out setting turned on. It is not acceptable to paste directly into the free web UI.

Level 3: Okay to Hand Over to External AI (Green Zone)

• Public information about your company (content available on your website)
• General industry knowledge questions
• Proofreading and translation (excluding confidential information)
• Program code (excluding proprietary logic)

→ Use this freely. Not using it would be a loss.

Level 4: Actively Hand Over to AI to Create Value (Blue Zone)

• Drafts for blog posts and social media content intended for publication
• Creating copy for recruitment pages
• Templates for general business emails
• Research and summarization of industry trends

→ Handing this over to AI can save 20 to 30 hours of one employee’s time per month. This translates to a cost reduction of 30,000 to 50,000 yen per month, or 360,000 to 600,000 yen annually. For small businesses, these numbers are significant.

—

Create a One-Page Internal Rule by the End of This Week

Condense the above four levels into one A4 page. The format should look like this:

“`
【AI Data Handling Rules】 (Established on YYYY/MM/DD)

■ Red (Absolutely NG): Customer personal information, contracts, account information, passwords
■ Yellow (Internal AI Only): Sales data, price lists, meeting minutes, proposals
■ Green (External AI OK): Public information, general questions, proofreading/translation
■ Blue (Active Use): Content for publication, template creation, research

【Rules by Tool】

• ChatGPT Web Version → Green and Blue only
• ChatGPT API Version (Opt-out ON) → Yellow and below OK
• Chrome Extension → Close Red and Yellow tabs when in use
• Amazon Bee and other voice devices → Turn off during internal meetings. Only on for casual chats and brainstorming
• Company smartphones → Allow location data only for necessary apps with “while using only” permission

Responsible Person: ○○ Last Updated: ○月○日
“`

That’s all. You can create a “minimum version” of an information security policy that would typically cost 200,000 to 300,000 yen if you hired a lawyer, in just 30 minutes by yourself. There’s no need to aim for perfection. The biggest risk is not having made any decisions.

—

Small Businesses Can Act This Week

For large corporations, revising security policies takes 3 to 6 months, involving drafting by the information systems department, legal review, approval by management meetings, company-wide notifications, and training.

In a company with 10 employees, you can simply distribute an A4 sheet at tomorrow’s morning meeting saying, “This is what we will follow starting today.” The speed of decision-making is the greatest weapon of small businesses.

Defining the boundaries of data handed to AI is not a technical issue; it is a management decision. And the company that can execute management decisions the fastest is not a large corporation, but yours.

Do it by the end of this week. Just one A4 page. This will be the turning point between making AI your “ally” or a “risk.”