Last week, I fed a client contract to AI

Last week I pasted a draft contract containing my client's real name into an AI to clean up the wording. Right after hitting send, panic kicked in—is this thing going to remember my client's info?

Anthropic did something this week that made me sit up

Anthropic announced this week they cut internet access to their internal environment used for evaluating AI. At first I brushed it off—they're an AI company, of course their eval setup has stricter rules.

But the more I thought about it: a company that studies AI all day is guarding against its own AI "going rogue"—worried about data leaking out during evaluation, or being contaminated from outside. For us folks feeding data to AI every day to get work done, shouldn't we also wonder: where exactly does the stuff I send actually go?

Someone I know actually got burned. Last year, Lao Chen, who runs a Xiaohongshu (Little Red Book) coaching business in Hangzhou, dumped real store names and conversion rates from his clients into some AI to help draft a strategy. The next week that AI updated its model, and Lao Chen discovered his clients' store names had "mysteriously" appeared elsewhere. After that, Lao Chen got smart: clients get code names, sensitive data gets anonymized before feeding, and if you don't have to send it, don't.

What you can do today: 3 zero-cost actions

Money: $0 (this is a mindset issue)

Time: 30 minutes before end of work today is enough

Technical barrier: just need to know how to use AI, no coding required

First step: open your last 10 conversations with an AI and check if any contain real client names or real numbers. Then do these three things:

  1. Swap real client names for code names like "Company A" or "Client B"
  2. Round off specific numbers, or make up plausible fake data in a reasonable range
  3. Set yourself an SOP: before feeding anything to AI, ask yourself "if this got published, could I live with it?"

How to do this at different stages

Just starting out / no clients yet: If you're only using AI to draft copy and reply to emails right now, you probably don't need to panic. But building the anonymization habit early isn't a loss—you'll have clients eventually.

Got 1-2 clients: This is the stage where you should be most alert—you haven't built the muscle memory yet, but you're already using AI on real business. Spending 30 minutes this week on the three steps above is 100x cheaper than cleaning up after a leak. I personally got burned at this exact stage.

Scaling up / team bigger than 1: You need more than personal anonymization—you need a process SOP. Set a team rule: what info can go to AI, what can't, and who checks. I only realized this needed to be a formal rule once my team hit 4 people; before that I was running naked.

One last thing: this isn't about telling you to stop using AI—AI is genuinely useful, I use it every day. Just don't treat AI as a "blind trust" tool. AI companies themselves guard against their own AI, so being a little paranoid isn't embarrassing. No pressure to try this today, but the awareness needs to be there.