A copy you can't take back

In April 2023, Samsung engineers uploaded internal source code to ChatGPT. Samsung then restricted generative AI tools on company devices. Its stated concern was simple: data sent to these services is stored on external servers, where it is hard to retrieve or delete.

Nobody had to break in. The code left the building through the front door, in a chat window, as part of someone doing their job.

Deleting a chat doesn't always delete it

On 13 May 2025, a federal judge in The New York Times v. OpenAI ordered OpenAI to preserve ChatGPT output logs, including conversations users had deleted. The order covered most consumer and API users. It ended on 26 September 2025, but logs already preserved stayed preserved, and accounts flagged in the case are still retained.

None of those users were party to the lawsuit. How long their words were kept was decided by a court case between two companies.

Leaks are usually ordinary

In January 2025, Wiz researchers found a DeepSeek database open to the internet with no authentication. It held more than a million lines of logs, including chat history and secret keys. DeepSeek secured it quickly after the report.

In July 2025, reporters found more than 4,500 shared ChatGPT conversations indexed by Google, some with personal details. People had ticked an option to make a shared link discoverable, often without realizing what it meant. OpenAI removed the option.

Neither case needed a sophisticated attacker. One was a misconfigured database. The other was a checkbox.

Recordings carry other people's words

A meeting recording isn't only yours. It holds the voices, names, and opinions of everyone in the room.

In August 2025, a class action against Otter.ai alleged that its notetaker joined meetings without participants' consent and that recordings were used to train its models. Otter says audio is de-identified before training, and the claims haven't been decided. Either way, the case shows what's at stake: once a recording is on someone else's server, the people in it depend on that company's settings and policies, not on yours.

You can't verify what you can't see

In September 2026, OpenAI announced a proof about the Navier–Stokes equations, one of mathematics' famous open problems. The proof remains unverified. NYU mathematician Tristan Buckmaster and a collaborator had spent most of a year on a closely related result, partly using OpenAI's public models. Buckmaster asked OpenAI employees whether its agents had accessed transcripts of that work. By his account, they said no, and didn't answer when he asked whether its models had been trained on them.

OpenAI denies using the pair's work, and its chief research officer repeated in a press briefing that neither its agents nor its staff accessed the transcripts. No evidence of misuse has been made public.

The point isn't that OpenAI did something wrong. It's that a researcher with a year of unpublished work had no way to check. His only option was to ask, and to trust the answer.

The bill when it goes wrong

IBM's 2026 study of 602 organizations put the average cost of a data breach at $4.99 million. One in four malicious breaches involved AI, at about $6 million each. The year before, IBM found that one in five breaches involved "shadow AI", meaning AI tools staff used without approval.

For an individual the cost isn't measured in millions. It's a client's confidential plan in someone else's logs, a private conversation in a search result, or research credited to someone else.

What running models locally changes

Every incident above has the same shape: a copy of someone's data existed on a server they didn't control. Running the model on your own computer removes that copy.

  • There's no provider log to leak, subpoena, or preserve.
  • There's no conversation to train on, and no policy change that can reach it later.
  • There's no sharing setting to get wrong, because nothing is uploaded to share.

That's how Lumen works. Transcription (Whisper large-v3-turbo), meeting notes (Gemma 4 E2B), and search (EmbeddingGemma 2) all run on the device. There's no account and no telemetry. The models download once from Hugging Face during setup. After that, the app and its AI processes have no network access, and we've tested transcription, notes, and search with networking blocked. Lumen reads only the folders you choose, records only when you start a recording or turn on automatic recording, and keeps activity memory off until you turn on a source. Nothing leaves until you save an export yourself.

What it doesn't change

Local isn't the same as invulnerable. When the data stays on your computer, your computer becomes the boundary.

  • Turn on disk encryption, such as FileVault on macOS. Lumen doesn't add its own encryption layer.
  • Check your backups and synced folders. An export saved to a synced folder follows that service's rules.
  • Keep the device patched. Malware with access to your account can read what you can.

Lumen also hasn't had an independent security audit yet, and its local models are smaller than the largest cloud models. That's one reason every generated note links to the part of the transcript it came from, so you can check it.

Cloud AI is useful, and for plenty of work the trade is reasonable. For client calls, unpublished research, and your own notes, the copy that can't leak is the one that never left your computer.